PCI SSCPCI DSSAccess ControlEASYFree question
What does PCI DSS require regarding physical access to the CDE?
- A.Any employee can enter the data center, since video surveillance on its own satisfies every physical access requirement in the standard
- B.Only electronic access matters
- C.Physical access must be restricted and monitored using appropriate controls
- D.Physical access is not addressed by PCI DSS, because facility protection is delegated to local building codes rather than to the card brands' standard
Why C is correct
PCI DSS Requirement 9 mandates restricting physical access to the CDE using badge systems, locks, cameras, and visitor logs.
Know someone studying for PCI DSS? Send them this one.