Which sub-requirement concerns administering user accounts, including additions, deletions, and modifications?

Which sub-requirement concerns administering user accounts, including additions, deletions, and modifications?

• A. Requirement 12.5.4
• B. Requirement 12.5.5
• C. Requirement 12.3.9
• D. Requirement 12.3.8

Answer: (A)

Administering user accounts means provisioning and managing the entire lifecycle of access: creating accounts for new users, updating permissions as roles change, and removing or disabling accounts when access is no longer needed. The sub-requirement that directly covers this practice specifies the need to administer user accounts, including additions, deletions, and modifications. Having a formal process for this ensures that only authorized individuals have access to cardholder data, and that access is promptly adjusted or removed as needed, which supports least privilege and auditability. Other sub-requirements in the vicinity focus on different aspects of access control and security, such as how authentication credentials are managed or how sessions are controlled or terminated. Those are important for overall security but do not address the provisioning and deprovisioning of user accounts themselves.

Administering user accounts means provisioning and managing the entire lifecycle of access: creating accounts for new users, updating permissions as roles change, and removing or disabling accounts when access is no longer needed. The sub-requirement that directly covers this practice specifies the need to administer user accounts, including additions, deletions, and modifications. Having a formal process for this ensures that only authorized individuals have access to cardholder data, and that access is promptly adjusted or removed as needed, which supports least privilege and auditability.

Other sub-requirements in the vicinity focus on different aspects of access control and security, such as how authentication credentials are managed or how sessions are controlled or terminated. Those are important for overall security but do not address the provisioning and deprovisioning of user accounts themselves.