Which of the following is a set of standard guidelines for ongoing development, enhancement, storage, dissemination and implementation of security…

Question breakdown

Tests

Recognize regulatory and compliance frameworks relevant to SOC

Difficulty

Easy

Key idea: PCI-DSS is the payment card industry standard that protects cardholder account data, and the PCI Security Standards Council develops and maintains it.

How to reach the answer

1. The decisive clue is 'account data protection,' meaning payment cardholder data.
2. The PCI SSC describes its mission as developing, enhancing, storing, disseminating and implementing security standards for account data.
3. FISMA covers US federal information systems and HIPAA covers health information.
4. DARPA is a research agency, not a compliance standard.

Each option

• AIncorrect. FISMA governs security for US federal agency information systems, not payment account data.
• BIncorrect. HIPAA protects patient health information in the US healthcare sector.
• CCorrect. PCI-DSS is the standard set maintained by the PCI SSC specifically for protecting payment account data.
• DIncorrect. DARPA is a US defense research agency and does not publish data protection compliance standards.

Common trap: FISMA or HIPAA can seem plausible because they are also security compliance frameworks, but neither is about account (card) data.

In practice: SOCs serving merchants or payment processors must meet PCI-DSS log monitoring and retention requirements, such as Requirement 10.

Remember: Account or cardholder data protection points to PCI-DSS.

Drafted with AI assistance and checked against the answer key.