What is required by documenting approvals for privileges?

What is required by documenting approvals for privileges?

• A. No approvals required; automatic provisioning.
• B. Require documented approval by authorized parties specifying required privileges.
• C. Only manager approval on quarterly basis.
• D. Approval is optional for contractors.

Answer: (B)

Documented approvals for privileges are essential to control who has elevated access and to prove accountability. In PCI DSS, granting privileged rights should follow a formal authorization process where someone authorized approves the specific privileges being granted, and that approval is recorded. This creates an auditable trail and enforces least-privilege, because access is linked to a defined job need and can be adjusted or revoked as responsibilities change. Relying on automatic provisioning, infrequent or optional approvals, or treating contractor access as exempt would weaken control and increase the risk of over-privileged or inappropriate access.

Documented approvals for privileges are essential to control who has elevated access and to prove accountability. In PCI DSS, granting privileged rights should follow a formal authorization process where someone authorized approves the specific privileges being granted, and that approval is recorded. This creates an auditable trail and enforces least-privilege, because access is linked to a defined job need and can be adjusted or revoked as responsibilities change. Relying on automatic provisioning, infrequent or optional approvals, or treating contractor access as exempt would weaken control and increase the risk of over-privileged or inappropriate access.