Which publications should the DBA review according to management?

• A. ISO 9001 and HIPAA
• B. PCI DSS and NIST Special Publication 800-63b
• C. COBIT and GDPR
• D. ISO 27001/27002 and CISA

Answer: (B)

The reasoning behind selecting PCI DSS and NIST Special Publication 800-63b as the appropriate publications for a Database Administrator (DBA) to review aligns with the need for data security and compliance with regulatory standards.

PCI DSS, or the Payment Card Industry Data Security Standard, is critical for any organization that handles credit card transactions. It outlines requirements for securing cardholder data and maintaining a secure payment environment. The DBA must be familiar with these standards to protect sensitive financial information stored in databases effectively.

NIST Special Publication 800-63b provides guidelines for digital identity management and is particularly relevant in managing user identities and access controls. This is vital for protecting database integrity and ensuring that only authorized users have access to data, which is a key responsibility for a DBA.

Together, these publications cater to the security and compliance requirements that are necessary for safeguarding sensitive data. They emphasize the importance of following industry standards to mitigate risks associated with data breaches and ensure adherence to regulatory obligations.