Information Security Policy and PCI DSS Requirements Quiz

Information Security Policy Document Control

• The Information Security Policy is a draft document that sets out the high-level policy objectives for information security within an organization.
• The policy defines requirements for protecting data, specifically cardholder data, based on the Payment Card Industry Data Security Standard (PCI DSS).
• The policy applies to all people, processes, and IT systems within the organization.
• The policy emphasizes the importance of individual actions and behaviors in protecting information assets.
• Personnel have specific responsibilities for protecting information and must attend information security awareness training.
• Line managers are responsible for ensuring their personnel receive training and have access to relevant policies and procedures.
• Senior management, including the CISO and policy manager, have specific responsibilities for information security within the organization.
• Network security is addressed in the policy, including firewall management and documentation, wireless networks, and system builds.
• Data security includes requirements for data storage and transmission, such as not storing sensitive authentication data and using encryption for cardholder data.
• Anti-virus software must be deployed on all systems and kept up to date.
• Patching and vulnerability management procedures are defined, including applying critical security updates and tracking vulnerabilities.
• Access control policies are outlined, including restrictions on system access and physical site access.

Note: The summary is based on the provided text and does not include information from the Annex or glossary sections.Summary of PCI DSS Requirements and Glossary of Terms

• Requirement 9 of PCI DSS mandates the assignment of a unique ID to each person with computer access.
• Requirement 10 requires the restriction of physical access to cardholder data.
• Requirement 11 states that all access to network resources and cardholder data must be tracked and monitored.
• Requirement 12 emphasizes the need for regular testing of security systems and processes.
• Annex A provides a glossary of terms related to PCI DSS.
• PCI DSS stands for Payment Card Industry Data Security Standard.
• The standard must be applied by entities that store, process, or transmit cardholder data.
• Insecure services are those that transmit data in an unencrypted format or are susceptible to well-known attacks or vulnerabilities.
• Public networks are networks that are not managed by the organization and can be monitored or intercepted by other entities.
• A DMZ, or Demilitarized Zone, is a subnet that exposes an organization's external-facing services to an untrusted network like the Internet.
• Inbound traffic refers to traffic coming from outside the organization and flowing into it via routers or firewalls.
• Outbound traffic refers to traffic coming from inside the organization and flowing out of it via routers or firewalls.
• Sensitive Authentication Data (SAD) includes full magnetic stripe data, PINs, PIN blocks, and the primary account number (PAN) used in relation to payment cards. Cardholder data (CHD) includes the PAN, cardholder name, expiration date, and service code.