Call Center Hosting Security & Compliance 1 — Questions and Answers
Question 1: Which compliance standard governs the security of cardholder data processed by call centers that handle credit card payments?
- HIPAA
- PCI DSS (Correct answer)
- SOX
- GDPR
Correct answer: PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for any system that stores, processes, or transmits cardholder data.
Question 2: What does HIPAA require of call centers that handle US patient health information?
- Minimum 256-bit encryption for all files
- Safeguarding protected health information (PHI) through administrative, physical, and technical controls (Correct answer)
- Storing all call recordings for 7 years minimum
- Conducting quarterly penetration testing
Correct answer: Safeguarding protected health information (PHI) through administrative, physical, and technical controls
HIPAA requires healthcare-related call centers to protect PHI through comprehensive administrative, physical, and technical safeguards.
Question 3: What is 'call recording pause-resume' compliance functionality?
- Pausing a call recording to insert hold music
- Automatically pausing call recordings when sensitive data (e.g., credit card numbers) is being captured (Correct answer)
- Resuming interrupted calls from where they left off
- A supervisor feature to pause agent monitoring
Correct answer: Automatically pausing call recordings when sensitive data (e.g., credit card numbers) is being captured
Pause-resume functionality stops recording during PCI-sensitive moments (like card number entry) to prevent cardholder data from being stored in recordings.
Question 4: What does 'end-to-end encryption' mean for call center voice communications?
- Encrypting data only at the server level
- Encrypting voice data from the caller's device all the way to the agent's endpoint so only endpoints can decrypt it (Correct answer)
- Using SSL certificates for the agent web portal
- Encrypting call recordings at rest
Correct answer: Encrypting voice data from the caller's device all the way to the agent's endpoint so only endpoints can decrypt it
End-to-end encryption ensures voice data is encrypted throughout its entire journey, preventing interception by network intermediaries.
Question 5: What is 'role-based access control' (RBAC) in a hosted call center platform?
- Routing calls based on agent seniority
- Restricting system access and features to users based on their defined role (agent, supervisor, admin) (Correct answer)
- Controlling physical access to the call center floor
- Assigning calls based on agent skill rating
Correct answer: Restricting system access and features to users based on their defined role (agent, supervisor, admin)
RBAC limits what each user can see and do in the platform based on their role, following the principle of least privilege.
Question 6: What is a 'data residency' requirement that affects hosted call center platform selection?
- The physical server room must be within the call center building
- A legal or regulatory requirement that customer data must be stored within a specific country or region (Correct answer)
- The amount of disk space reserved for call recordings
- The requirement for data to be backed up daily
Correct answer: A legal or regulatory requirement that customer data must be stored within a specific country or region
Data residency rules require that certain customer data be stored only within specified geographic boundaries, affecting which cloud regions can be used.
Call Center Hosting Security & Compliance 1
Which compliance standard governs the security of cardholder data processed by call centers that handle credit card payments?