Which PCI DSS requirement addresses the use of unique identities and authentication methods to access system components?

Which PCI DSS requirement addresses the use of unique identities and authentication methods to access system components?

• A. Requirement 7
• B. Requirement 10
• C. Requirement 8
• D. Requirement 12

Answer: (C)

The concept being tested is identifying and authenticating access to system components. This requirement mandates that every person or entity has a unique identifier and must prove who they are before gaining access, using appropriate authentication methods such as passwords, tokens, or multi-factor authentication. It also covers provisioning and deprovisioning access and managing credentials securely, which directly addresses how to control and verify who can reach system components. Other PCI DSS areas touch related security topics but not this specific mechanism. For example, restricting access based on need-to-know focuses on limiting who can reach cardholder data, rather than how identities are uniquely established and verified. Tracking and monitoring access deals with logging and auditing rather than the creation and management of unique user identities and their authentication. And having a general security policy governs governance and program-level requirements, not the operational control of unique identities and authentication.

The concept being tested is identifying and authenticating access to system components. This requirement mandates that every person or entity has a unique identifier and must prove who they are before gaining access, using appropriate authentication methods such as passwords, tokens, or multi-factor authentication. It also covers provisioning and deprovisioning access and managing credentials securely, which directly addresses how to control and verify who can reach system components.

Other PCI DSS areas touch related security topics but not this specific mechanism. For example, restricting access based on need-to-know focuses on limiting who can reach cardholder data, rather than how identities are uniquely established and verified. Tracking and monitoring access deals with logging and auditing rather than the creation and management of unique user identities and their authentication. And having a general security policy governs governance and program-level requirements, not the operational control of unique identities and authentication.