CPSA_P_New Exam Preparation Material | Card Production Security AssessorCPSA Physical NewExam

Explanation:
According to the PCI Card Production and Provisioning Physical Security Requirements, the HSA Access Control system must enforce both dual control and dual presence principles. Dual control means that at least two authorized individuals must act together to perform a critical function or access a sensitive area. Dual presence means that at least two authorized individuals must be physically present in the same area at all times. These principles are intended to prevent unauthorized or fraudulent activities by requiring mutual supervision and accountability. Therefore, the HSA Access Control system must ensure that no single individual can enter, exit, or operate within the HSA without the cooperation and the presence of another authorized individual.
References:
PCI Card Production and Provisioning Physical Security Requirements, Version 1.0, April 2019, page 121
PCI Card Production and Provisioning Physical Security Requirements, Version 1.0, April 2019, page 131

Explanation:
According to the PCI Card Production and Provisioning C Physical Security Requirements, the Security Manager is the person who is responsible for approving visitor entry to the High Security Area (HSA) or cloud-based provisioning environment. The HSA is the area where card production and provisioning activities take place, such as card manufacturing, personalization, PIN generation and printing, and fulfillment. The cloud-based provisioning environment is the logical equivalent of the HSA for entities that provide over-the-air (OTA) provisioning or host card emulation (HCE) provisioning services. The Security
Manager must ensure that visitors have a legitimate business need to enter the HSA or cloud-based provisioning environment, and must authorize their access in advance. The Security Manager must also maintain a visitor log that records the visitor’s name, company, date, time, and purpose of visit, as well as the escort’s name and signature. The Security Manager must also ensure that visitors are escorted by authorized personnel at all times, and that they wear a distinctive visitor badge. The head of the vendor facility, the Production Manager, or any other person is not required to approve visitor entry to the HSA or cloud-based provisioning environment, unless they are also designated as the Security Manager by the vendor.
References:
Payment Card Industry (PCI) Card Production and Provisioning C Physical Security Requirements, Section 3.1.1 and 3.1.2
Payment Card Industry (PCI) Card Production and Provisioning C Glossary of Terms, Abbreviations, and
Acronyms, Definitions of Security Manager, High Security Area, Cloud-Based Provisioning Environment,
OTA Provisioning, and HCE Provisioning
Quest

Explanation:
According to the Card Production Security Assessor (CPSA) Qualification Requirements, an assessor must provide their client with a Quality Assurance Manual at the start of every assessment. The Quality Assurance Manual is a document that describes the assessor’s methodology, procedures, and quality control measures for conducting assessments. The manual must be consistent with the CPSA Program Guide and the PCI Card Production and Provisioning Security Requirements. The manual must also include a description of the assessor’s roles and responsibilities, the assessment scope and objectives, the assessment plan and timeline, the assessment report format and content, and the assessor’s conflict of interestpolicy.
References: Card Production Security Assessor (CPSA) Qualification Requirements, v1.0, April 2019, page 111
Reference: [Reference: https://listings.pcisecuritystandards.org/documents/Card_Production_Security__Assessor_(CPSA)_Quali fication_Requirements__v1.0_Apr__2019.pdf, ]

Explanation:
Reference: https://www.shrm.org/hr-today/news/hr-magazine/summer2022/pages/termination-tips-for-hr-practitioners.aspx

Explanation:
According to the PCI Card Production Physical Security Requirements, one of the security controls for card shipment is to ensure that the vendor has an incident response plan in place to handle any card shipment incidents, such as loss, theft, or tampering.
The incident response plan should include the following steps1:
The vendor should conduct an incident review to determine the cause and scope of the incident, and document the findings and actions taken.
The vendor should notify the VPA, the issuer, and law enforcement of the incident within 24 hours of discovery, or as soon as possible.
The vendor should cooperate with the VPA, the issuer, and law enforcement in the investigation and resolution of the incident, and provide any evidence or information requested.
The vendor should implement corrective actions to prevent the recurrence of the incident, and report the results to the VPA and the issuer. Therefore, the response that best reflects a compliant organization is option D, which follows the steps of the incident response plan as required by the PCI Card Production Physical Security Requirements.
References: PCI Card Production Physical Security Requirements, Version 1.0, April 2019, Section 1.1, Objective 6, Requirement 6.2, Page 131