Which PCI DSS requirement focuses on proper user identification management for non-consumer users and administrators on all system components?

Which PCI DSS requirement focuses on proper user identification management for non-consumer users and administrators on all system components?

• A. Requirement 7.3
• B. Requirement 8.1
• C. Requirement 6.2
• D. Requirement 9.3

Answer: (B)

The main concept being tested is ensuring that every non-consumer user and administrator has a unique identity and must be authenticated to access any system component. This creates accountability, prevents the sharing of credentials, and allows access to be granted, monitored, and revoked across the entire environment. PCI DSS requires identifying and authenticating all users who can interact with system components storing or processing cardholder data, so this focus directly addresses who can log in and how they prove who they are, across all relevant devices and software. This is why it’s the best fit: it targets the fundamental mechanism by which access is controlled and tracked—identity verification for every user, including admins, across the whole infrastructure. Other topics, while important, concern different aspects of security such as restricting access based on job function, establishing policies, or physical security. None of those alone centers on the core practice of unique user identification and authentication across all system components.

The main concept being tested is ensuring that every non-consumer user and administrator has a unique identity and must be authenticated to access any system component. This creates accountability, prevents the sharing of credentials, and allows access to be granted, monitored, and revoked across the entire environment. PCI DSS requires identifying and authenticating all users who can interact with system components storing or processing cardholder data, so this focus directly addresses who can log in and how they prove who they are, across all relevant devices and software.

This is why it’s the best fit: it targets the fundamental mechanism by which access is controlled and tracked—identity verification for every user, including admins, across the whole infrastructure. Other topics, while important, concern different aspects of security such as restricting access based on job function, establishing policies, or physical security. None of those alone centers on the core practice of unique user identification and authentication across all system components.