Which PCI DSS standard is primarily concerned with regularly monitoring and testing networks?

Which PCI DSS standard is primarily concerned with regularly monitoring and testing networks?

• A. Standard 2 Protect Cardholder Data
• B. Standard 5 Regularly Monitor and Test Networks
• C. Standard 3 Maintain a Vulnerability Management Program
• D. Standard 6 Maintain an Information Security Policy

Answer: (B)

Regular monitoring and testing of networks focuses on keeping security controls active and effective over time. In PCI DSS, this is the standard that requires regularly monitoring and testing security systems and processes and tracking access to network resources. It covers activities such as continuous network monitoring, vulnerability scanning, penetration testing, and reviewing logs to detect and respond to security events and to verify that controls continue to function correctly after changes. This is why it’s the best fit for “regularly monitoring and testing networks.” The other standards address different areas: protecting cardholder data, maintaining a vulnerability management program, and upholding an information security policy, none of which center on ongoing network monitoring and testing.

Regular monitoring and testing of networks focuses on keeping security controls active and effective over time. In PCI DSS, this is the standard that requires regularly monitoring and testing security systems and processes and tracking access to network resources. It covers activities such as continuous network monitoring, vulnerability scanning, penetration testing, and reviewing logs to detect and respond to security events and to verify that controls continue to function correctly after changes. This is why it’s the best fit for “regularly monitoring and testing networks.” The other standards address different areas: protecting cardholder data, maintaining a vulnerability management program, and upholding an information security policy, none of which center on ongoing network monitoring and testing.