Who is the primary person responsible for an entity's security-related matters?

• A. Security Policy
• B. Self-Assessment Questionnaire
• C. Secure Wipe
• D. Security Officer

Answer: (D)

The main idea is accountability for security within an organization. A designated individual who has the authority and responsibility to oversee the security program is essential to ensure that policies are followed, controls are implemented, and security incidents are managed. In PCI DSS, there is typically an appointed Security Officer who bears overall responsibility for protecting cardholder data and for the security program’s effectiveness. This role isn’t just about having a policy or a process; it’s about having a person who leads, coordinates, and enforces security measures across the organization.

The other items are important components but not the person in charge: a Security Policy is the formal document outlining requirements, a Self-Assessment Questionnaire is a tool for evaluating compliance, and a Secure Wipe is a data sanitization action. Therefore, the Security Officer is the correct answer.