What is one requirement of PCI DSS regarding credit card data?

Question

Options

• ACredit card data should be pseudonymized and segregated into another database
• BCredit card data is retained for shorter periods than any other data
• CNo employee can ever see unmasked credit card data of a data subject
• DCredit card data should be classified as confidential and encrypted

• A
  2% (1)
• B
  4% (2)
• C
  2% (1)
• D
  92% (46)

Explanation

PCI DSS (Payment Card Industry Data Security Standard) requires that cardholder data be classified as sensitive and protected with strong encryption both at rest and in transit. Option D correctly reflects this core requirement. Option A is partially aligned with privacy principles but pseudonymization and segregation are not a specific PCI DSS mandate in those terms. Option B is incorrect - PCI DSS does not require credit card data to be retained for shorter periods than other data; it actually mandates minimizing retention. Option C is false - PCI DSS allows authorized personnel to view masked card data under controlled conditions, and some roles require access.

No community discussion yet for this question.