Annual secure coding training should include which element?

• A. Understanding how sensitive data is handled in memory and secure coding guidelines
• B. Marketing skills
• C. Network topology
• D. Customer support

Answer: (A)

Understanding how sensitive data is handled in memory, along with secure coding guidelines, is essential in annual secure coding training. When developers know where data resides in memory and how it can be exposed, they can implement safeguards to prevent leakage, tampering, or unauthorized access. This includes practices like minimizing in-memory storage of secrets, securely clearing memory when data is no longer needed, using safe APIs for handling sensitive values, and following established secure coding guidelines that address common weaknesses. These elements together provide practical, day-to-day actions that reduce vulnerabilities and protect cardholder data in PCI environments. Marketing skills, network topology, and customer support are not directly about writing secure code, so they don’t fit the focus of secure coding training.