Which statement about PCI DSS 6.5 is true?

Which statement about PCI DSS 6.5 is true?

• A. It focuses on secure communications only.
• B. It includes coverage for injection flaws, buffer overflows, insecure crypto storage, insecure communications, improper error handling, XSS, and high-risk vulnerabilities.
• C. It only requires developers to document training.
• D. It prohibits any code review.

Answer: (B)

PCI DSS 6.5 is about secure coding practices within the software development lifecycle and the kinds of vulnerabilities that must be addressed in developed software. The statement that best fits this requirement is that it includes coverage for injection flaws, buffer overflows, insecure cryptographic storage, insecure communications, improper error handling, XSS, and high-risk vulnerabilities. This reflects the standard’s emphasis on mitigating a broad range of common and critical weaknesses in applications, not just one narrow area. Why this is correct is that PCI DSS 6.5 explicitly targets secure development and coding practices and enumerates or implies these categories of vulnerabilities as the kinds of issues that should be prevented or remediated during development, testing, and deployment. It promotes secure coding guidelines, proper testing, and remediation, and it often involves practices like code reviews to catch such flaws before software is released. The other options don’t fit because PCI DSS 6.5 is not limited to secure communications alone, it isn’t satisfied by merely documenting training, and it does not prohibit code reviews. In fact, secure development typically involves code reviews and broader safeguards across the SDLC to address the listed vulnerability classes.

PCI DSS 6.5 is about secure coding practices within the software development lifecycle and the kinds of vulnerabilities that must be addressed in developed software. The statement that best fits this requirement is that it includes coverage for injection flaws, buffer overflows, insecure cryptographic storage, insecure communications, improper error handling, XSS, and high-risk vulnerabilities. This reflects the standard’s emphasis on mitigating a broad range of common and critical weaknesses in applications, not just one narrow area.

Why this is correct is that PCI DSS 6.5 explicitly targets secure development and coding practices and enumerates or implies these categories of vulnerabilities as the kinds of issues that should be prevented or remediated during development, testing, and deployment. It promotes secure coding guidelines, proper testing, and remediation, and it often involves practices like code reviews to catch such flaws before software is released.

The other options don’t fit because PCI DSS 6.5 is not limited to secure communications alone, it isn’t satisfied by merely documenting training, and it does not prohibit code reviews. In fact, secure development typically involves code reviews and broader safeguards across the SDLC to address the listed vulnerability classes.