12.3.1 requires?

12.3.1 requires?

• A. Automatic approval after login
• B. Global policy approval by executives
• C. No approval required
• D. Explicit approval by authorized parties

Answer: (D)

Changes to the PCI environment must go through a formal change-management process, with explicit authorization before implementation. This means a specific, documented sign-off from individuals who have the authority to approve changes that could affect security or cardholder data. The approval step ensures the change is reviewed for risk, tested in a controlled setting, and accompanied by details like the testing results and a back-out plan. Automatic approval after login would bypass this critical governance; having no approval at all would be reckless; and a broad, high-level policy sign-off from executives doesn’t ensure the individual change is vetted and authorized. Explicit approval by authorized parties provides the necessary accountability and control over security-related modifications.

Changes to the PCI environment must go through a formal change-management process, with explicit authorization before implementation. This means a specific, documented sign-off from individuals who have the authority to approve changes that could affect security or cardholder data. The approval step ensures the change is reviewed for risk, tested in a controlled setting, and accompanied by details like the testing results and a back-out plan. Automatic approval after login would bypass this critical governance; having no approval at all would be reckless; and a broad, high-level policy sign-off from executives doesn’t ensure the individual change is vetted and authorized. Explicit approval by authorized parties provides the necessary accountability and control over security-related modifications.