A qualified assessor evaluating the company's compliance with the Payment Card Industry Data Security Standard asks the DBA team how cardholder data in the database is protected, accessed and retained, and wants documented evidence. What best satisfies this request?
Select an answer to reveal the explanation.
Short Explanation
Auditors live by a simple rule: if it isn't written down, it didn't happen. Documented procedures for handling card data are your evidence that you do things the way the standard expects. A diagram or an uptime report doesn't prove any of that.
Full Explanation
Third-party compliance means meeting requirements imposed by an external standard, regulator or contract, such as PCI DSS for organizations that store, process or transmit cardholder data. Assessors look for documented policies and procedures and for evidence that they are followed. SOPs that describe how cardholder data is encrypted, how access is requested, approved and reviewed, how keys are managed, how logs are monitored and how data is retained and securely deleted provide that documentation, and the records produced when staff follow them provide the evidence. An ERD shows structure and relationships; it cannot demonstrate that encryption is applied or that access is controlled, so presenting it as proof of encryption misstates what the document contains. An SLA availability report measures service uptime, which is not what the assessor asked about and does not address data protection. A gap analysis of a hardware refresh concerns future capacity planning and is unrelated to how cardholder data is currently handled. Exam caveat: specific PCI DSS requirement numbers and testing procedures are defined by the standard itself, so rely on the concept of documented, followed procedures rather than memorized clause numbers. Operational check: map each SOP to the requirement it supports and confirm that recent execution records exist for each one.