For third-party repair or maintenance personnel, what action is required before granting access to devices?

For third-party repair or maintenance personnel, what action is required before granting access to devices?

• A. Grant access after verifying identity.
• B. Verify the identity before granting access.
• C. Grant access to anyone who claims to be from a device vendor.
• D. Do not verify identity ever.

Answer: (B)

Verifying the person’s identity before granting access is essential. When third-party repair or maintenance personnel need to connect to devices, confirming who they are ensures that only authorized individuals can reach systems that may handle sensitive data. This proactive check prevents impersonation, supports accountability, and makes it possible to apply the correct access controls (distinct credentials, time-bound permissions, and activity logging). With identity verified upfront, you can grant the appropriate level of access and monitor or revoke it if needed, maintaining a clear audit trail for compliance. Granting access after verification is basically the same in outcome, but the emphasis should be on confirming identity before any access is allowed rather than giving access first and then verifying. Allowing access to anyone who says they’re from a device vendor clearly bypasses the necessary checks and opens the door to unauthorized activity. Never verify identity is incompatible with secure practices and PCI DSS requirements.

Verifying the person’s identity before granting access is essential. When third-party repair or maintenance personnel need to connect to devices, confirming who they are ensures that only authorized individuals can reach systems that may handle sensitive data. This proactive check prevents impersonation, supports accountability, and makes it possible to apply the correct access controls (distinct credentials, time-bound permissions, and activity logging). With identity verified upfront, you can grant the appropriate level of access and monitor or revoke it if needed, maintaining a clear audit trail for compliance.

Granting access after verification is basically the same in outcome, but the emphasis should be on confirming identity before any access is allowed rather than giving access first and then verifying. Allowing access to anyone who says they’re from a device vendor clearly bypasses the necessary checks and opens the door to unauthorized activity. Never verify identity is incompatible with secure practices and PCI DSS requirements.