A city portal that accepts credit cards for recreation fees must protect cardholder data. Which industry standard should the design align with?
Select an answer to reveal the explanation.
Short Explanation
If your portal touches credit cards, think PCI DSS—the playbook for cardholder data—not produce grades or paint codes. You need to align the cloud design with payment-card security expectations.
Full Explanation
PCI DSS requirements for environments that store, process, or transmit payment card data are the correct standard. PCI DSS is the industry security standard for organizations that store, process, or transmit payment card data. The city portal that accepts credit cards for recreation fees must align architecture, access control, logging, encryption, and evidence with PCI DSS expectations so cardholder data belonging to residents is protected to the payment industry baseline. Unrelated standards do not substitute for cardholder-data protections. Agricultural produce grading rules, even if park concessions sell food, do not define payment-card security controls for the portal. Only interior office painting standards are facilities concerns unrelated to CHD protection. Shipboard radio licensing rules have no bearing on municipal card processing. Exam caveat: PCI DSS applicability hinges on storing, processing, or transmitting cardholder data (and related scope decisions such as using a hosted payment field to reduce scope). SAQ type and environment scope matter on deeper questions. Operational check: determine CHD data flow for the recreation portal, minimize scope where possible, implement required TLS, access, logging, and segmentation controls, and retain evidence for assessment. Engage QSA/SAQ processes as appropriate and re-validate after major portal changes.