Which statement describes facility entry controls for the cardholder data environment?

Which statement describes facility entry controls for the cardholder data environment?

• A. Use appropriate facility entry controls to limit and monitor physical access to systems in the cardholder data environment.
• B. Facility entry controls are optional for small offices.
• C. Facility entry controls apply only to digital systems.
• D. Facility entry controls are not required for POS terminals.

Answer: (A)

Physical access controls are critical for protecting the cardholder data environment. They limit and monitor who can physically enter facilities and rooms that house systems handling cardholder data, such as servers, network gear, and POS terminals. This prevents unauthorized individuals from tampering with or stealing devices that process or store CHD. The statement reflects the PCI DSS requirement to restrict physical access to the CDE (and to monitor it), and it applies regardless of organization size. It isn’t limited to digital systems, and POS terminals that process CHD fall under the CDE, so they also require facility entry controls.

Physical access controls are critical for protecting the cardholder data environment. They limit and monitor who can physically enter facilities and rooms that house systems handling cardholder data, such as servers, network gear, and POS terminals. This prevents unauthorized individuals from tampering with or stealing devices that process or store CHD. The statement reflects the PCI DSS requirement to restrict physical access to the CDE (and to monitor it), and it applies regardless of organization size. It isn’t limited to digital systems, and POS terminals that process CHD fall under the CDE, so they also require facility entry controls.