A payment processor used for recreation fees triggers an industry-standard forensic review after suspected card skimming. What should the city security lead understand?
Select an answer to reveal the explanation.
Short Explanation
When card skimming hits a recreation payment flow, the payment brands and rules can demand a real forensic look — not just an internal chat. That industry path sits beside any regulator notice duties. Treat it as more than a help-desk ticket.
Full Explanation
Industry standards and regulators can impose investigative and notification duties beyond a city's internal ticket process. When a recreation payment processor triggers an industry-standard forensic review after suspected card skimming, the security lead should understand that payment-brand or PCI-related paths—and possibly regulatory notice—may require specific forensic scoping, qualified investigators, and timelines that a purely internal review does not satisfy.
Asserting that only internal IT tickets matter and that payment brands never impose investigative obligations ignores card-industry incident response expectations. Handling skimming suspicions solely by rewriting a recreation brochure addresses marketing, not forensic or compliance duty. Claiming industry forensic reviews forbid preserving logs until marketing approves messaging inverts priorities: evidence preservation comes first; messaging follows lawful and procedural constraints.
Exam caveat: Payment-card incident stems often add an industry investigation layer on top of administrative response. Choose the answer that acknowledges those external forensic/notification requirements.
Operational check: Engage the processor and counsel immediately, preserve POS and network logs, follow the applicable brand/PCI incident plan, isolate suspected skimming vectors, and track notification obligations to card brands, acquirers, and residents as required.