Which PCI DSS requirement requires assigning all users a unique ID before accessing system components or cardholder data?

Which PCI DSS requirement requires assigning all users a unique ID before accessing system components or cardholder data?

• A. Requirement 8.1.3
• B. Requirement 7.1
• C. Requirement 8.1.1
• D. Requirement 9.4

Answer: (C)

Assigning a unique identifier to every person who can access system components or cardholder data establishes individual accountability. When each user has their own ID, every action can be attributed to a specific person, which is essential for monitoring, auditing, and enforcing access controls. This exact principle is what PCI DSS requires to control who can reach sensitive systems and data before access is granted. Other choices touch on related ideas like limiting access by role or guarding physical areas, but they don’t establish the core step of giving each user a distinct ID that enables precise attribution of actions.

Assigning a unique identifier to every person who can access system components or cardholder data establishes individual accountability. When each user has their own ID, every action can be attributed to a specific person, which is essential for monitoring, auditing, and enforcing access controls. This exact principle is what PCI DSS requires to control who can reach sensitive systems and data before access is granted. Other choices touch on related ideas like limiting access by role or guarding physical areas, but they don’t establish the core step of giving each user a distinct ID that enables precise attribution of actions.