Under PCI DSS, which requirement requires restricting access to cardholder data by business need to know?

Under PCI DSS, which requirement requires restricting access to cardholder data by business need to know?

• A. Requirement 2
• B. Requirement 7
• C. Requirement 1
• D. Requirement 4

Answer: (B)

The key idea is controlling who can actually access cardholder data by giving access only to people whose roles require it. PCI DSS requires strong access controls that follow the least-privilege principle, meaning access to cardholder data must be restricted to individuals with a legitimate business need to know their role and responsibilities. This is implemented by using unique user IDs, role-based or need-to-know access, formal provisioning and revocation processes, and regular access reviews to ensure permissions stay appropriate. Other areas of PCI DSS cover different protections—securely configuring networks and systems, protecting data in transit, and overall security policies—but they don’t address the specific access-control mandate as directly as the need-to-know restriction does. So the requirement that mandates restricting access to cardholder data by business need to know is the correct one.

The key idea is controlling who can actually access cardholder data by giving access only to people whose roles require it. PCI DSS requires strong access controls that follow the least-privilege principle, meaning access to cardholder data must be restricted to individuals with a legitimate business need to know their role and responsibilities. This is implemented by using unique user IDs, role-based or need-to-know access, formal provisioning and revocation processes, and regular access reviews to ensure permissions stay appropriate.

Other areas of PCI DSS cover different protections—securely configuring networks and systems, protecting data in transit, and overall security policies—but they don’t address the specific access-control mandate as directly as the need-to-know restriction does. So the requirement that mandates restricting access to cardholder data by business need to know is the correct one.