DSS stands for Data Security Standard. In the PCI context, which statement about DSS is true?

• A. It is a general IT governance framework
• B. It describes incident response workflow
• C. It specifies security requirements for protecting cardholder data
• D. It defines security scanning procedures

Answer: (C)

The main idea being tested is what PCI DSS is actually designed to do. PCI DSS is a standard that sets the security requirements for protecting cardholder data across the environments where that data is stored, processed, or transmitted. That focus on safeguarding cardholder data is why the statement that it specifies security requirements for protecting cardholder data is the correct one. It isn’t just a broad IT governance framework, nor is it defined solely by incident response workflows, and while it includes requirements related to security monitoring and vulnerability scanning, those are components of the larger goal of protecting cardholder data, not the entire purpose by themselves.