The Payment Card Industry Data Security Standard (PCI DSS) contains six different categories of control objectives. Each objective contains one or more requirements, which must be followed in order to achieve compliance. Which of the following requirements would best fit under the objective, "Implement strong access control measures"?

The Payment Card Industry Data Security Standard (PCI DSS) objective "Implement Strong Access Control Measures" focuses on ensuring that access to system components and cardholder data is restricted to authorized individuals. Requirement 8 of the PCI DSS, "Identify and authenticate access to system components," explicitly mandates assigning a unique ID to each person with computer access. This fundamental control ensures that every action on the network can be traced back to a specific, known user, which is a cornerstone of secure access management and accountability.

A. Regularly test security systems and processes.

This requirement falls under the PCI DSS objective "Regularly Monitor and Test Networks," which focuses on vulnerability scanning, penetration testing, and intrusion detection/prevention.

B. Encrypt transmission of cardholder data across open, public networks.

This is a requirement under the objective "Protect Cardholder Data," which deals with safeguarding data both at rest (storage) and in transit using strong cryptography.

D. Use and regularly update anti-virus software on all systems commonly affected by malware.

This requirement is part of the objective "Maintain a Vulnerability Management Program," which includes protecting systems against malware and ensuring security patches are applied.

1. PCI Security Standards Council. (2022). Payment Card Industry (PCI) Data Security Standard: Requirements and Security Assessment Procedures

Version 4.0. Page 11

"PCI DSS Goals and Requirements" table.

Goal: Implement Strong Access Control Measures: This goal encompasses Requirement 8

"Identify Users and Authenticate Access to System Components." Requirement 8.2.1 specifically states

"Assign all users a unique ID before allowing them to access system components or cardholder data

" directly supporting option C.

The same table maps the other options to their respective goals: Requirement 11 ("Test Security of Systems and Networks Regularly") to "Regularly Monitor and Test Networks" (Option A); Requirement 4 to "Protect Cardholder Data" (Option B); and Requirement 5 ("Protect All Systems and Networks from Malicious Software") to "Maintain a Vulnerability Management Program" (Option D).

2. Cornell University. (n.d.). IT@Cornell Policy Office: PCI DSS Requirements. Cornell University. Retrieved from https://it.cornell.edu/policy/pci-dss-requirements

This university resource outlines the 12 PCI DSS requirements grouped by the six control objectives. It explicitly lists "Assign a unique ID to each person with computer access" under Goal 4: "Implement Strong Access Control Measures."