Which agreement requires organizations that collect, store, or process credit card information to abide by?

• A. COPPA
• B. PIPEDA
• C. Common Criteria (CC)
• D. Payment Card Industry Data Security Standard (PCI DSS)

Answer: (D)

Standards for protecting cardholder data require organizations that handle payment card information to follow a defined set of security controls. The PCI DSS is the standard created by the major card brands to enforce those controls. It applies to any merchant or service provider that stores, processes, or transmits credit card data and requires practices like encrypting data in transit, minimizing stored card data, implementing strong access controls, regularly testing security systems, and maintaining an ongoing security program. This focus on safeguarding card data distinguishes PCI DSS from the other options, which cover different areas: COPPA protects children’s online privacy, PIPEDA governs general personal data in Canada, and Common Criteria is a framework for evaluating IT product security. PCI DSS is the one specifically tied to credit card information and the security measures surrounding its handling.