12.3.7 requires?

12.3.7 requires?

• A. List of company-approved products
• B. Acceptable uses of the technology
• C. A method to determine owner
• D. Explicit approval by authorized parties

Answer: (A)

The essential idea here is about controlling what technologies are allowed to be used in the PCI environment. Having a list of company-approved products creates a formal, auditable catalog of hardware and software that have been evaluated and authorized for use. This catalog helps ensure that only vetted, properly configured items are deployed, making it easier to enforce security standards, track changes, and demonstrate compliance during audits. Why this fits best: a defined approved-products list serves as the concrete artifact that organizations can rely on to enforce governance, reduce the risk of introducing untested or insecure components, and simplify ongoing management like patching and configuration verification. It establishes a baseline for what is permitted and provides a clear reference for both IT and security teams. Why the other ideas aren’t as fitting: describing acceptable uses of the technology focuses on user or operational behavior rather than the actual inventory of permitted technologies. A method to determine owner emphasizes ownership responsibility, which is important but does not specify the catalog that enforces what’s allowed in the environment. Explicit approval by authorized parties speaks to who signs off on changes, but the requirement is best satisfied by having a tangible list of approved products as the enforceable artifact.

The essential idea here is about controlling what technologies are allowed to be used in the PCI environment. Having a list of company-approved products creates a formal, auditable catalog of hardware and software that have been evaluated and authorized for use. This catalog helps ensure that only vetted, properly configured items are deployed, making it easier to enforce security standards, track changes, and demonstrate compliance during audits.

Why this fits best: a defined approved-products list serves as the concrete artifact that organizations can rely on to enforce governance, reduce the risk of introducing untested or insecure components, and simplify ongoing management like patching and configuration verification. It establishes a baseline for what is permitted and provides a clear reference for both IT and security teams.

Why the other ideas aren’t as fitting: describing acceptable uses of the technology focuses on user or operational behavior rather than the actual inventory of permitted technologies. A method to determine owner emphasizes ownership responsibility, which is important but does not specify the catalog that enforces what’s allowed in the environment. Explicit approval by authorized parties speaks to who signs off on changes, but the requirement is best satisfied by having a tangible list of approved products as the enforceable artifact.