An organization is subject to the Payment Card Industry Data Security Standard (PCI DSS). Which action is required when they discover that a business process is no longer compliant with a specific PCI DSS control?

Question

Accepted Answer

B. Document the non-compliance, assess the scope, and implement remediation or compensating controls. PCI DSS compliance requires ongoing monitoring and remediation. When non-compliance is discovered, the organization must document the gap, assess the risk scope, and implement remediation to restore compliance or deploy compensating controls if the standard control cannot be implemented. Compensating controls must provide equivalent protection to the original requirement.

An organization is subject to the Payment Card Industry Data Security Standard (PCI DSS). Which action is required when they discover that a business process is no longer compliant with a specific PCI DSS control?

Related Questions

Discussion