Which PCI DSS requirement emphasizes documenting security policies and procedures for restricting access to cardholder data?

Which PCI DSS requirement emphasizes documenting security policies and procedures for restricting access to cardholder data?

• A. Requirement 7.3
• B. Requirement 3.2
• C. Requirement 9.5
• D. Requirement 12.1

Answer: (A)

The main idea here is that access to cardholder data must be governed by a clearly documented policy. This requirement asks you to establish, publish, and maintain a formal policy that defines who may access CHD, under what conditions, and how those access permissions are granted, reviewed, and revoked. Having this policy documented ensures consistent enforcement of the need-to-know principle and makes accountability and audits straightforward, since everyone follows a published rule set rather than ad hoc decisions. Other controls may address specific technical or procedural aspects, but they don’t emphasize the practice of documenting the access-restriction policy itself, which is why this one best matches the prompt.

The main idea here is that access to cardholder data must be governed by a clearly documented policy. This requirement asks you to establish, publish, and maintain a formal policy that defines who may access CHD, under what conditions, and how those access permissions are granted, reviewed, and revoked. Having this policy documented ensures consistent enforcement of the need-to-know principle and makes accountability and audits straightforward, since everyone follows a published rule set rather than ad hoc decisions. Other controls may address specific technical or procedural aspects, but they don’t emphasize the practice of documenting the access-restriction policy itself, which is why this one best matches the prompt.