Which PCI DSS requirement restricts access to cardholder data by business need to know?

Which PCI DSS requirement restricts access to cardholder data by business need to know?

• A. Identify and authenticate access to system components
• B. Restrict physical access to cardholder data
• C. Restrict access to cardholder data by business need to know
• D. Track and monitor all access to network resources and cardholder data

Answer: (C)

Access control based on need to know is the key idea. PCI DSS directs that access to cardholder data should be restricted to individuals who genuinely need it to perform their jobs, a practice that embodies the least-privilege principle. This means granting access only to those roles or functions that require it, and nothing more. This exact wording and intent—the restriction by business need to know—is what differentiates it from the other controls. Identifying and authenticating access to system components focuses on verifying identity before access, not on limiting who can access CHD in the first place. Restricting physical access covers the physical presence of data, not digital access rights. Tracking and monitoring all access relates to auditing and visibility after access occurs, not the initial restriction itself. So the best fit is the requirement that restricts access to cardholder data by business need to know.

Access control based on need to know is the key idea. PCI DSS directs that access to cardholder data should be restricted to individuals who genuinely need it to perform their jobs, a practice that embodies the least-privilege principle. This means granting access only to those roles or functions that require it, and nothing more.

This exact wording and intent—the restriction by business need to know—is what differentiates it from the other controls. Identifying and authenticating access to system components focuses on verifying identity before access, not on limiting who can access CHD in the first place. Restricting physical access covers the physical presence of data, not digital access rights. Tracking and monitoring all access relates to auditing and visibility after access occurs, not the initial restriction itself.

So the best fit is the requirement that restricts access to cardholder data by business need to know.