Which PCI DSS requirement maintains a policy that addresses information security for all personnel?

Which PCI DSS requirement maintains a policy that addresses information security for all personnel?

• A. Identify and authenticate access to system components
• B. Do not use vendor-supplied defaults for system passwords and other security parameters
• C. Protect stored cardholder data
• D. Maintain a policy that addresses information security for all personnel

Answer: (D)

Having a formal security policy that applies to everyone who handles cardholder data is essential because it provides the governance framework for how information security is managed across the organization. In PCI DSS, there is a requirement that specifically calls for maintaining a policy addressing information security for all personnel. This policy sets expectations, responsibilities, acceptable-use rules, training requirements, and compliance practices for every person—employees, contractors, and third parties alike. It ensures consistent behavior and serves as the foundation for implementing and enforcing all other security controls. The other options describe important technical measures—how access is identified and authenticated, avoiding vendor defaults for passwords, and protecting stored cardholder data—but they focus on specific controls rather than establishing the overarching policy that governs all personnel.

Having a formal security policy that applies to everyone who handles cardholder data is essential because it provides the governance framework for how information security is managed across the organization. In PCI DSS, there is a requirement that specifically calls for maintaining a policy addressing information security for all personnel. This policy sets expectations, responsibilities, acceptable-use rules, training requirements, and compliance practices for every person—employees, contractors, and third parties alike. It ensures consistent behavior and serves as the foundation for implementing and enforcing all other security controls.

The other options describe important technical measures—how access is identified and authenticated, avoiding vendor defaults for passwords, and protecting stored cardholder data—but they focus on specific controls rather than establishing the overarching policy that governs all personnel.