A security analyst is preparing a vulnerability-management compliance report for an upcoming PCI-DSS audit. Which section of the report would MOST directly demonstrate to the auditors that the organization satisfies the standard's requirements?
A narrative executive summary highlighting recent security program improvements
A control-to-requirement mapping matrix correlating internal controls to each applicable PCI-DSS clause
A graph showing the ten most exploited vulnerabilities detected during the last quarter
A table listing patch-deployment dates for all critical production servers
Auditors need clear evidence that each control the organization has implemented satisfies a particular PCI-DSS clause. A control-to-requirement mapping matrix provides that direct linkage, making it the section that most convincingly demonstrates compliance. A graph of common vulnerabilities, an executive narrative, or a patch-deployment table are useful context but do not explicitly map controls to the standard's mandatory clauses and therefore do not, by themselves, prove adherence.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are regulatory requirements in compliance reports?
Open an interactive chat with Bash
What is included in a compliance report?
Open an interactive chat with Bash
Why is it important to include a detailed section showing adherence to regulatory requirements?