Examkin

Question

Difficulty: MediumRegulatory Compliance and Legal Requirements Management

An e-commerce merchant processes payment card transactions through its internal application servers and stores transaction history in an on-premises database. To align with Payment Card Industry Data Security Standard (PCI-DSS) requirements and minimize compliance audit costs, the chief information security officer (CISO) wants to reduce the overall scope of the Cardholder Data Environment (CDE). Which of the following technical controls will most effectively reduce the organization's PCI-DSS compliance scope?

  1. Implementing tokenization to replace Primary Account Numbers (PAN) with non-sensitive surrogate values prior to internal storageAnswer
  2. B
    Applying AES-256 field-level symmetric encryption to cardholder data while storing the cryptographic keys on the database server
  3. C
    Mandating annual security awareness training for all staff who interact with payment processing workflows
  4. D
    Deploying an automated vulnerability scanner to conduct weekly network scans against external web endpoints

Answer

Implementing tokenization to replace Primary Account Numbers (PAN) with non-sensitive surrogate values prior to internal storage is the correct control for scope reduction.
Tokenization replaces sensitive cardholder data with non-sensitive reference tokens. When internal applications and databases store only tokens rather than actual Primary Account Numbers (PAN), the underlying infrastructure no longer stores or processes Cardholder Data (CHD), effectively removing those systems from the PCI-DSS audit boundary and reducing compliance scope.

Step-by-Step Solution

1
Analyze the goal of PCI-DSS scope reduction
Scope reduction requires ensuring systems no longer store, process, or transmit cleartext Cardholder Data (CHD) or Sensitive Authentication Data (SAD).
Systems that do not touch or store sensitive payment card details can be excluded from the strict audit boundary of the Cardholder Data Environment (CDE).
2
Evaluate the effect of tokenization versus encryption
Tokenization replaces sensitive primary account numbers (PAN) with mathematically unrelated surrogate values (tokens) that cannot be reverse-engineered without out-of-scope vaulted systems.
Because internal databases store only non-sensitive tokens rather than actual card numbers, those databases fall out of PCI-DSS scope.
3
Confirm why other technical and administrative controls fail to reduce scope
Field-level encryption, awareness training, and vulnerability scanning fulfill compliance requirements but still leave systems containing or managing cardholder data within PCI-DSS scope.
Only mechanisms that completely remove cleartext payment data from environment boundaries succeed in reducing compliance scope.

Key Concept

PCI-DSS Scope Reduction via Tokenization
Rate this question

Topics

Regulatory Compliance and Legal Requirements Management

More questions from this topic