CompTIA CySA+ Practice Test

Upon a data breach involving credit card information, what disclosure must be made according to PCI-DSS compliance?

1. Notification to local law enforcement

2. Notification to your credit card processor

3. Notification to federal law enforcement

4. Notification to Visa and Mastercard

The correct answer is: Notification to your credit card processor

The requirement to notify your credit card processor in the event of a data breach involving credit card information is rooted in the obligations set forth by the Payment Card Industry Data Security Standard (PCI-DSS). This standard mandates that any entity that handles credit card data must have protocols in place for incident response, including timely notifications to relevant stakeholders following a breach. Notifying the credit card processor is crucial because they play a central role in the transaction routing and processing for credit card payments. They need to be involved in investigating the breach, understanding the scope of the incident, and assessing any potential fraud that may arise. This enables them to take necessary actions to mitigate risks and protect consumers' financial information. While notifying law enforcement or the card networks such as Visa and Mastercard could also be part of best practices or may be required under different circumstances, PCI-DSS specifically emphasizes the importance of direct communication with the credit card processor to manage the security implications of the breach effectively.