Question

A retail company processes credit card payments through a legacy point-of-sale application that cannot support the multi-factor authentication required by PCI DSS for administrative access to the cardholder data environment. The application vendor will not release a compliant version for 14 months. The security manager wants to remain compliant with the standard during this period. Which approach correctly satisfies PCI DSS requirements for this situation?

Accepted Answer

Document a compensating control that meets the intent and rigor of the original requirement, includes a defined risk analysis, and is validated by the QSA and reassessed annually

Answer

Accept the residual risk formally through a signed risk acceptance memo from the CISO and continue processing without further action

Answer

Remove MFA from the requirement scope by reclassifying the POS system as a low-impact asset until the vendor patch is available

Answer

Self-attest that the control gap is a known limitation and defer remediation until the next annual assessment cycle