Which statement best describes the aim of access control for system components and cardholder data?

Which statement best describes the aim of access control for system components and cardholder data?

• A. Grant access based on seniority rather than need.
• B. Limit access to system components and cardholder data to only those individuals whose job requires such access.
• C. Provide blanket access to all systems.
• D. Delay access until the annual review.

Answer: (B)

Access control for system components and cardholder data is about enforcing least privilege and need-to-know: only people whose roles require access should be granted it, and those privileges should be reviewed and updated as needed. This approach minimizes the chance that sensitive data is exposed to anyone who doesn’t truly need it to do their job, which is a core principle behind PCI DSS. The best statement reflects this idea by saying access should be limited to individuals whose job requires it. Granting access based on seniority doesn’t align with actual need to perform tasks, so it can expose data more than necessary. Providing blanket access to all users defeats the purpose of restricting sensitive information. Delaying access until an annual review ignores real-time needs and maintenance of proper privileges, which should be granted and adjusted as roles change and duties evolve.

Access control for system components and cardholder data is about enforcing least privilege and need-to-know: only people whose roles require access should be granted it, and those privileges should be reviewed and updated as needed. This approach minimizes the chance that sensitive data is exposed to anyone who doesn’t truly need it to do their job, which is a core principle behind PCI DSS.

The best statement reflects this idea by saying access should be limited to individuals whose job requires it. Granting access based on seniority doesn’t align with actual need to perform tasks, so it can expose data more than necessary. Providing blanket access to all users defeats the purpose of restricting sensitive information. Delaying access until an annual review ignores real-time needs and maintenance of proper privileges, which should be granted and adjusted as roles change and duties evolve.