What does PCI DSS require regarding critical technology usage policies?

• A.Written approval from the acquirer for each new technology, a warranty for each purchased device, and a list of retired products must be documented in the annual risk assessment
• B.Approval by the CISO for personal devices, acceptable uses of removable media, password complexity settings, and a list of approved vendors must be documented in the awareness program
• C.Explicit approval of technology use, acceptable uses, authentication requirements, approved devices and locations, and a list of approved products must be documented
• D.Acceptable uses, device inventories, patch schedules, and a list of approved firewalls must be documented in the policy