PCI SSCPCI DSSAccess ControlEASYFree question
What principle does PCI DSS Requirement 7 enforce regarding access to cardholder data?
- A.Only personnel with a documented business role are granted access to cardholder data across every processing system (role-based access)
- B.Only IT administrators can view cardholder data across any assigned system (admin-only rule)
- C.Access to cardholder data must be restricted to only those individuals whose job requires such access (need-to-know)
- D.Only encryption administrators can configure cardholder data access across the CDE (crypto officer role)
Why C is correct
Requirement 7 enforces the principle of least privilege and need-to-know, ensuring that access to systems and cardholder data is limited to only those personnel whose job function requires it.
Know someone studying for PCI DSS? Send them this one.