Which Security Standard Applies to a Credit Card Company Penetration Test?
Bill has been hired as a penetration tester and cyber security auditor for a major credit card company. Which information security standard is most applicable to his role?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests your ability to match an industry-specific compliance framework to the business sector named in the scenario; the trap is picking a broad government law such as FISMA or SOX because it contains the word 'audit.'
This CEH question asks which information security standard governs a penetration tester and auditor hired by a major credit card company. PCI-DSS is the Payment Card Industry Data Security Standard that mandates periodic penetration testing and regular audits for any organization that processes, stores, or transmits cardholder data.
The most common wrong instinct is selecting Sarbanes-Oxley (B), because SOX is famous for financial audit requirements — but it applies to public company financial reporting, not to card payment data security. FISMA (A) governs U.S. federal information systems and HITECH (C) governs protected health information, so neither fits a credit card issuer.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
PCI-DSS (D) is the only standard in the list written specifically for the payment card industry. Any entity that processes, stores, or transmits cardholder data — including a credit card company hiring a penetration tester and cyber security auditor — must comply with PCI-DSS Requirement 11, which requires regular penetration testing of networks and security systems, as well as regular audits by a Qualified Security Assessor (QSA) or internal auditor. Bill's dual role as penetration tester and security auditor maps directly onto the PCI-DSS testing and validation regime.Why the Other Options Are Wrong
FISMA (A) applies to U.S. federal government agencies and their information systems, imposing NIST-based security controls and audits on federal data — it has no jurisdiction over a private credit card issuer. Sarbanes-Oxley (B) is a U.S. law focused on the accuracy of public companies' financial reporting and the effectiveness of internal financial controls; it audits financial statements, not cardholder data environments. HITECH (C) enforces HIPAA protections for electronic protected health information, which concerns healthcare data, not payment card data. None of these three standards would make Bill's penetration testing of a card company's payment environment a compliance requirement.Community Comment Notes
The community agreed unanimously with D, with one hundred percent of votes on the answer. As LordXander summarized the exam heuristic: "Whenever you are seeing the words credit card and audit, you click on PCI DSS - no question asked." insaniunt also expanded the acronym as "D. PCI-DSS (Payment Card Industry Data Security Standard)," confirming the same mapping of the payment card industry to the standard.Official Reference
Exam Strategy
Use keyword-to-framework mapping on the exam: credit card or payment card data means PCI-DSS, federal systems means FISMA/NIST, health records means HIPAA/HITECH, and public company financial reporting means SOX. Recognizing the sector named in the stem lets you answer instantly without analyzing each distractor in depth.
Frequently Asked Questions
Why is Sarbanes-Oxley not the answer when it also involves audits?
SOX audits a public company's internal financial reporting controls, not its payment card data environment. PCI-DSS is the standard that specifically mandates penetration testing for cardholder data systems.
Does FISMA or HITECH ever apply to a credit card issuer?
No. FISMA covers U.S. federal information systems and HITECH covers electronic protected health information. A private credit card company falls under PCI-DSS instead.