How should onsite personnel access to sensitive areas be controlled?

How should onsite personnel access to sensitive areas be controlled?

• A. Access must be authorized and based on individual job function; termination revokes access and returns or disables credentials.
• B. Access is granted to all onsite staff by default.
• C. Access is revoked only after a month.
• D. Access is based on seniority rather than function.

Answer: (A)

Access to sensitive areas must be granted only to individuals who need it for their specific role, and those permissions must be actively provisioned and revoked as roles change or people leave. This approach embodies the least-privilege principle and ensures ongoing protection of cardholder data environments. When access is tied to individual job function and credentials are returned or disabled upon termination, former employees or unauthorized staff cannot enter restricted spaces, even if they previouslyhad access. Granting access to all onsite staff by default ignores risk and defeats controls. Revoking access after only a short period, like a month, leaves a large window for potential abuse or oversights. Basing access on seniority rather than function doesn't align with what a person actually needs to perform their job, which can either over-provision or under-provision privileges.

Access to sensitive areas must be granted only to individuals who need it for their specific role, and those permissions must be actively provisioned and revoked as roles change or people leave. This approach embodies the least-privilege principle and ensures ongoing protection of cardholder data environments. When access is tied to individual job function and credentials are returned or disabled upon termination, former employees or unauthorized staff cannot enter restricted spaces, even if they previouslyhad access.

Granting access to all onsite staff by default ignores risk and defeats controls. Revoking access after only a short period, like a month, leaves a large window for potential abuse or oversights. Basing access on seniority rather than function doesn't align with what a person actually needs to perform their job, which can either over-provision or under-provision privileges.