1B: Acknowledge Compliance Requirements

Question 1

Which standard specifies the controls that must be in place to securely handle credit card data?

Answer 1

Payment Card Industry Data Security Standard (PCI-DSS)

Question 2

How many categories does the PCI-DSS standard use to describe what is required?

Answer 2

Six Categories

Question 3

Of the four PCI-DSS levels, which level defines a merchant with over six million transactions a year?

Answer 3

Level 1

Question 4

Of the four PCI-DSS levels, which level defines a merchant with one to six million transactions a year?

Answer 4

Level 2

Question 5

Of the four PCI-DSS levels, which level defines a merchant with 20,000 to one million transactions a year?

Answer 5

Level 3

Question 6

Of the four PCI-DSS levels, which level defines a small merchant with under 20,000 transactions a year?

Answer 6

Level 4

Question 7

Of the four PCI-DSS levels, which level must have an external auditor perform the assessment by an approved Qualified Security Assessor (QSA)?

Answer 7

Level 1

Question 8

Of the four PCI-DSS levels, which levels must complete a Report on Compliance (RoC)?

Answer 8

Level 1 and 2

Question 9

Of the four PCI-DSS levels, which levels can either have an external auditor or submit a self-test that proves they are taking active steps to secure the infrastructure?

Answer 9

Levels 2-4

Question 10

In 2018 the EU enacted this regulation which outlines specific requirements on how consumer data is protected.The law affects anyone who does business with residents of the EU and Britain. This comprehensive law focuses on the privacy of consumer data and, more importantly, gives consumers the ability to control how their data is handled.

Answer 10

General Data Protection Regulation (GDPR)

Question 11

A law that was enacted in New York state in March 2020 to protect citizens data. The law requires companies to bolster their cybersecurity defense methods to prevent a data breach and protect consumer data.

Answer 11

Stop Hacks and Improve Electronic Data Security (SHIELD)

Question 12

This law was enacted in 2020 and outlines specific guidelines on how to appropriately handle consumer data. To ensure that customer data is adequately protected, vendors should include PenTesting of all web applications, internal systems along with social engineering assessments.

Answer 12

California Consumer Privacy Act (CCPA)

Question 13

A law that mandates rigorous requirements for anyone that deals with patient information.

Answer 13

Health Insurance Portability and Accountability Act (HIPPA)