Which of the following is NOT part of PCI-DSS requirements?

Which of the following is NOT part of PCI-DSS requirements?

• A. Access control measures
• B. Encryption of cardholder data
• C. Storing passwords in plain text
• D. Regular security testing

Answer: (C)

Storing passwords in plain text is not part of PCI-DSS requirements because it poses a significant security risk. The PCI-DSS (Payment Card Industry Data Security Standard) is designed to enhance security for payment card data and protect sensitive information. One of its core principles is to protect stored cardholder data, which includes implementing strong access controls, encrypting sensitive information, and utilizing secure methods for data storage. Storing passwords in plain text would violate this principle, as it makes them easily accessible to unauthorized individuals, increasing the risk of data breaches. In contrast, the other choices—access control measures, encryption of cardholder data, and regular security testing—are essential components of PCI-DSS requirements that help ensure the security of payment information. Access controls restrict who can access sensitive data, encryption protects data during transmission and storage, and regular security testing identifies vulnerabilities to be mitigated. Thus, the correct answer highlights a method that directly contradicts the intent of the PCI-DSS framework.

Storing passwords in plain text is not part of PCI-DSS requirements because it poses a significant security risk. The PCI-DSS (Payment Card Industry Data Security Standard) is designed to enhance security for payment card data and protect sensitive information. One of its core principles is to protect stored cardholder data, which includes implementing strong access controls, encrypting sensitive information, and utilizing secure methods for data storage.

Storing passwords in plain text would violate this principle, as it makes them easily accessible to unauthorized individuals, increasing the risk of data breaches. In contrast, the other choices—access control measures, encryption of cardholder data, and regular security testing—are essential components of PCI-DSS requirements that help ensure the security of payment information. Access controls restrict who can access sensitive data, encryption protects data during transmission and storage, and regular security testing identifies vulnerabilities to be mitigated. Thus, the correct answer highlights a method that directly contradicts the intent of the PCI-DSS framework.