Parking payment kiosks that handle cardholder data need unbiased assurance before peak festival season. Which assessment approach best fits?
Select an answer to reveal the explanation.
Short Explanation
When card data is in play, you want a ref who doesn’t play for the home team. Independent third-party audit beats a friendly self-pat on the back.
Full Explanation
Parking payment kiosks that handle cardholder data introduce PCI-relevant risk for the city. Before peak festival season, unbiased assurance is best obtained through an independent third-party audit of the PCI-relevant payment environment. Independence reduces conflicts that occur when the same team that built or operates the kiosks grades itself, and third-party scrutiny aligns with how payment stakeholders expect card data environments to be validated.
An internal developer self-check with no independence from the payment team lacks objectivity and is weak evidence for external reliance. A volunteer survey asking whether the kiosk 'felt secure' measures perception, not control design or operation. Skipping assurance because parking revenue is 'low sensitivity by default' misunderstands PCI: cardholder data sensitivity is not waived by municipal parking context or seasonal volume assumptions.
Exam caveat: When card data appears, Security+ answers favor independent third-party assessment over self-checks, surveys, or sensitivity hand-waving.
Operational check: inventory CHD flows (kiosk, gateway, receipts, logs), confirm segmentation and key management, schedule a qualified assessor or approved scanning/penetration activities as required by the city’s PCI level, remediate findings before festival load, and retain reports for acquirer or bank requests.