A campus bookstore stores and processes payment card numbers on its point-of-sale systems. Which framework applies to that card data?
Select an answer to reveal the explanation.
Short Explanation
If the cash register holds card numbers, the rule book you open is the payment-card standard, not a privacy law written for personal data in general and not a network loop-prevention protocol. That card-data standard is PCI DSS. This question is about which framework fits, not about giving the bookstore legal advice.
Full Explanation
PCI DSS is the security standard that applies when a merchant stores, processes, or transmits payment card data. The bookstore does that on its point-of-sale systems, so PCI DSS is the framework the design has to follow. GDPR protects personal data of people in the European Union. Cardholder data can also be personal data, and the stem asks about the standard that applies because the data are payment cards, which is PCI DSS. A service-level agreement is a provider uptime commitment. It does not set the security rules for card data. Spanning tree prevents switching loops. It is not a compliance framework, even though segmentation of the card systems is a control you might use while meeting PCI DSS. Exam caveat: naming the framework is not legal advice, and the bookstore still needs its own compliance program. Operational check: put the point-of-sale systems on a segmented network, limit who can reach the card data, and map those controls back to the PCI DSS requirements the acquirer expects.