Examkin

Question

Difficulty: EasyData Privacy and Compliance Regulations

An IT technician is setting up a point-of-sale system for a retail business. The store owner requests that customer credit card numbers and three-digit security codes be saved in cleartext on a local workstation to streamline recurring transactions. Which of the following compliance standards directly prohibits storing unencrypted payment card data and sensitive authentication information?

  1. PCI-DSSAnswer
  2. B
    HIPAA
  3. C
    FERPA
  4. D
    GDPR

Answer

PCI-DSS (Payment Card Industry Data Security Standard)
PCI-DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. Storing unencrypted cardholder data or sensitive authentication values (such as CVV/CVC codes) post-authorization is a strict violation of PCI-DSS requirements.

Step-by-Step Solution

1
Identify the data type involved in the scenario
The scenario specifically deals with payment card data, including full credit card numbers and security codes.
Determining the data classification narrows down the applicable compliance framework.
2
Match the data classification with its governing regulatory standard
Payment card information (PCI) and cardholder data are governed by PCI-DSS.
PCI-DSS sets mandatory technical security requirements for any organization that stores, processes, or transmits credit card details.

Key Concept

Payment Card Industry Data Security Standard (PCI-DSS) Compliance Requirements
Rate this question

Topics

Data Privacy and Compliance Regulations

More questions from this topic