Which sub-requirement focuses on monitoring and controlling all access to data?

Which sub-requirement focuses on monitoring and controlling all access to data?

• A. Requirement 12.4
• B. Requirement 12.3.10
• C. Requirement 12.5.5
• D. Requirement 12.5.1

Answer: (C)

Monitoring and controlling access to data means you must both limit who can reach cardholder data and have visibility into every access attempt. The sub-requirement in this area is about putting in place processes that enforce who is allowed to access data (least-privilege access) and, importantly, logging and regularly reviewing those access events to detect and respond to any unauthorized or inappropriate access. That combination—restricting access and continuously monitoring it—is what lines up with the idea of monitoring and controlling all access to data, making it the best fit. Other sub-requirements tend to focus on establishing policies, defining access by role, or protecting data in other ways (like encryption or physical security) without centering on the ongoing monitoring and control of access to the data itself.

Monitoring and controlling access to data means you must both limit who can reach cardholder data and have visibility into every access attempt. The sub-requirement in this area is about putting in place processes that enforce who is allowed to access data (least-privilege access) and, importantly, logging and regularly reviewing those access events to detect and respond to any unauthorized or inappropriate access. That combination—restricting access and continuously monitoring it—is what lines up with the idea of monitoring and controlling all access to data, making it the best fit.

Other sub-requirements tend to focus on establishing policies, defining access by role, or protecting data in other ways (like encryption or physical security) without centering on the ongoing monitoring and control of access to the data itself.