You are building policies for a merchant to ensure PCI compliance website. What two action items do you write in the policy to maintain PCI compliance?

Maintaining PCI DSS compliance requires adhering to specific security controls. Requirement 6.2 of the PCI DSS mandates that entities protect systems from known vulnerabilities by installing critical vendor-supplied security patches within one month (30 days) of release. This directly corresponds to option B. Furthermore, Requirement 8.2 mandates assigning a unique ID to each person with computer access to ensure that actions are traceable to a specific, known individual. Using shared or generic credentials, especially for administrative access, is a direct violation of this principle. This supports option C.

A. Purging logs after 30 days violates PCI DSS Requirement 10.7, which mandates retaining audit log history for at least one year.
D. The 72-hour data breach notification is a requirement of the GDPR (General Data Protection Regulation), not the PCI DSS.

1. PCI Security Standards Council. (2018). Payment Card Industry Data Security Standard (PCI DSS) v3.2.1.

For Answer B: Requirement 6.2 states

"Protect all system components and software from known vulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release." (Page 61).

For Answer C: Requirement 8.2 states

"In addition to assigning a unique ID

ensure proper user-authentication management for non-consumer users and administrators on all system components..." This is based on the core principle of assigning a unique ID to each person with access. (Page 77).

For Incorrect Option A: Requirement 10.7 states

"Retain audit trail history for at least one year

with a minimum of three months immediately available for analysis." (Page 96).

2. Adobe. (2023). A guide to PCI DSS v4.0 compliance for Adobe Commerce merchants. Adobe Security Center Whitepaper.

For Answer B: Under the section for "Requirement 6: Develop and Maintain Secure Systems and Software

" the guide reiterates the need to "Install critical or high-risk security patches within one month of identification." (Page 10).

For Answer C: The section "Requirement 8: Identify Users and Authenticate Access to System Components" emphasizes that "All users must be assigned a unique ID before being allowed to access system components or cardholder data." (Page 11).