What must be true about security policies & operational procedures for protecting stored CHD?

• A. Not required to be known by all users.
• B. Only in draft form and not distributed.
• C. Documented, in use, and known to all affected parties.
• D. Limited to security staff only.

Answer: (C)

Policies and procedures for protecting stored cardholder data must be formalized, actively used, and shared with everyone who handles or is affected by CHD protection. Documenting them creates a clear, enforceable standard that the organization follows. Ensuring they are in use means the procedures are actually implemented in day-to-day operations, not just sitting in a manual. Making them known to all affected parties—such as employees, contractors, and any personnel who handle CHD—ensures people understand how to protect data, follow consistent steps, and can be held accountable if they don’t.

If policies exist only as drafts, or are kept only within a small group, or aren’t distributed to those who must follow them, there’s no reliable guidance or awareness to support secure handling of CHD. That’s why the best practice is to have documented, in-use policies that are known to everyone involved.