If there is an authorized business need to access cardholder data via remote-access technologies, what must the usage policies require?

If there is an authorized business need to access cardholder data via remote-access technologies, what must the usage policies require?

• A. Data must be protected in accordance with all applicable PCI DSS Requirements.
• B. Data must be copied to local drives for quick access.
• C. Data must be deleted after each session.
• D. Data must be encrypted using only simple encryption.

Answer: (A)

When there is an authorized business need to access cardholder data remotely, usage policies must require that the data be protected in accordance with all applicable PCI DSS requirements. This is because remote access broadens the potential attack surface, so any access to CHD must be governed by the same protective controls that PCI DSS mandates—strong authentication and access controls, encryption where appropriate, ongoing monitoring and logging, secure configurations, and proper key management. The goal is to ensure that cardholder data remains protected throughout remote sessions and that access is strictly limited to individuals with a legitimate need to know, with auditable records of activity. Reasons the other options don’t fit: copying data to local drives creates additional copies and elevates risk, violating data minimization and protection principles; deleting data after each session is not a universal PCI DSS requirement and could interfere with legitimate business processes; relying on simple encryption does not meet PCI DSS standards for strong cryptography and key management.

When there is an authorized business need to access cardholder data remotely, usage policies must require that the data be protected in accordance with all applicable PCI DSS requirements. This is because remote access broadens the potential attack surface, so any access to CHD must be governed by the same protective controls that PCI DSS mandates—strong authentication and access controls, encryption where appropriate, ongoing monitoring and logging, secure configurations, and proper key management. The goal is to ensure that cardholder data remains protected throughout remote sessions and that access is strictly limited to individuals with a legitimate need to know, with auditable records of activity.

Reasons the other options don’t fit: copying data to local drives creates additional copies and elevates risk, violating data minimization and protection principles; deleting data after each session is not a universal PCI DSS requirement and could interfere with legitimate business processes; relying on simple encryption does not meet PCI DSS standards for strong cryptography and key management.