Which PCI DSS requirement focuses on restricting and monitoring access to network resources and cardholder data?

Which PCI DSS requirement focuses on restricting and monitoring access to network resources and cardholder data?

• A. Requirement 10
• B. Requirement 7
• C. Requirement 3
• D. Requirement 9

Answer: (A)

Tracking and monitoring access to network resources and cardholder data is essential because it creates an audit trail that makes it possible to detect unauthorized activity, verify what users did, and respond quickly to security incidents. The requirement that focuses on this aspect asks organizations to implement logging, continuous monitoring, and alerting so every access event—who did it, what was accessed, when, and from where—can be reviewed and acted upon. Restricting access by need to know is about limiting who can access cardholder data, which is important but primarily concerns controlling access rather than providing visibility into ongoing access activity. The other options address protecting stored data or physical security, not the ongoing monitoring and auditing of access. So the best fit is the tracking and monitoring of access to network resources and cardholder data.

Tracking and monitoring access to network resources and cardholder data is essential because it creates an audit trail that makes it possible to detect unauthorized activity, verify what users did, and respond quickly to security incidents. The requirement that focuses on this aspect asks organizations to implement logging, continuous monitoring, and alerting so every access event—who did it, what was accessed, when, and from where—can be reviewed and acted upon.

Restricting access by need to know is about limiting who can access cardholder data, which is important but primarily concerns controlling access rather than providing visibility into ongoing access activity. The other options address protecting stored data or physical security, not the ongoing monitoring and auditing of access. So the best fit is the tracking and monitoring of access to network resources and cardholder data.