Which PCI DSS requirement states to develop and maintain secure systems and applications?

Which PCI DSS requirement states to develop and maintain secure systems and applications?

• A. Requirement 6
• B. Requirement 7
• C. Requirement 9
• D. Requirement 12

Answer: (A)

This item tests security through the software development and maintenance lifecycle. It focuses on building and keeping software and systems secure, which means applying secure coding practices, conducting security testing, enforcing change control, and promptly applying patches and remediating vulnerabilities as systems evolve. In short, it’s about integrating security into how systems and applications are created and kept up to date. That’s why this option is the best fit: it explicitly targets developing and maintaining secure systems and applications. The other ideas address different aspects—restricting who can access cardholder data, physical access controls, or overarching information security policy—rather than the ongoing security of the software and systems themselves.

This item tests security through the software development and maintenance lifecycle. It focuses on building and keeping software and systems secure, which means applying secure coding practices, conducting security testing, enforcing change control, and promptly applying patches and remediating vulnerabilities as systems evolve. In short, it’s about integrating security into how systems and applications are created and kept up to date.

That’s why this option is the best fit: it explicitly targets developing and maintaining secure systems and applications. The other ideas address different aspects—restricting who can access cardholder data, physical access controls, or overarching information security policy—rather than the ongoing security of the software and systems themselves.