An e-commerce company that provides payment gateways is concerned about the growing expense and time associated with PCI audits of its payment gateways and external audits by customers for their own…

Question

Options

• AInvest in new UBA to detect report, and remediate attacks faster
• BSegment the network to reduce and limit the audit scope
• CUndertake ISO certification for all core infrastructure including datacenters.
• DImplement a GRC system to track and monitor controls
• EImplement DLP controls on HTTP'HTTPS and email
• FInstall EDR agents on all corporate endpoints

• A
  5% (2)
• B
  3% (1)
• C
  62% (23)
• D
  8% (3)
• F
  22% (8)

Explanation

ISO 27001 certification (C) provides a recognized third-party attestation of security controls, which can satisfy many customers' own compliance audit requirements without requiring separate engagements - directly reducing the number and cost of external audits. Implementing DLP controls on HTTP/HTTPS and email (E) enforces data protection policies over existing network infrastructure, minimizing infrastructure costs while addressing PCI DSS cardholder data protection requirements. Together, they reduce audit burden, leverage existing infrastructure, and provide attestation. Note: Network segmentation (B) is also commonly cited for reducing PCI DSS scope, but the combination of ISO attestation and DLP aligns more specifically with all four of the CIO's stated goals.

No community discussion yet for this question.