In addition to annual execution, when else must risk assessments be performed?

• A. After every incident
• B. Upon significant changes to the environment
• C. Never
• D. Only during external audits

Answer: (B)

The main idea is that risk assessments in PCI DSS aren’t a one-off annual task; they must be revisited whenever the environment changes in ways that could affect risk. The best choice is to perform a risk assessment upon significant changes to the environment because such changes can introduce new threats, alter how cardholder data flows, or affect the effectiveness of existing controls. Reassessing ensures the risk posture and the controls stay aligned with the current situation.

For example, adding a new payment channel, moving data to a cloud service, changing network topology, or onboarding a new third-party processor are all significant changes that can shift risk levels and require updated risk treatment.

Choosing to assess risk only after incidents, never, or only during external audits doesn’t fit because risk management is ongoing and should respond to changes in the environment, not be limited to incidents or audits.