What policy does PCI DSS require for third-party/vendor access?

• A.Policies must define vendor access approval, authentication, monitoring, time limits, and require that access is enabled only when needed and disabled when not in use
• B.Approval and authentication must be defined for vendors, and policies require that vendor accounts remain enabled permanently once approved with sessions reviewed only during the annual assessment
• C.Policies must require vendors to hold their own QSA certificate, route sessions through the merchant VPN, and share one account only among the support engineers on the contract
• D.Policies must cap vendor sessions at one hour, require a signed NDA from each engineer, and allow exceptions only when the vendor is a validated service provider listed with the card brands