Who must the information security policy apply to?

• A.All employees and full time contractors who handle card payments, while consultants and temporary staff follow the policies of their agencies
• B.All personnel with administrator rights on CDE systems, plus the executive management team and the board of directors who sign the attestation
• C.All personnel including employees, contractors, consultants, and temporary workers who have access to the CDE or cardholder data
• D.All staff of the payment processing department and the call center, including seasonal workers who take card numbers over the telephone