The PCI Card Production and Provisioning Security Requirements mandate that a vendor must have a formal process for terminating personnel. In any legally compliant and structured organization, the Human Resources (HR) department is the designated owner of such formal processes. HR's involvement is essential to ensure that the termination is handled in accordance with labor laws, company policies, and contractual obligations. Notifying HR is the foundational step that initiates the formal termination workflow, which then includes coordinating with other departments, such as IT and security, to revoke access and secure company assets.

A. The employee must be escorted from the premises immediately

This is a common security practice but is a component of the termination process, not the mandatory initiating step. The primary PCI requirement is the immediate revocation of access, which this action supports.

B. The employee's locker and desk must be searched prior to termination

This is not a PCI requirement. Such actions are governed by company policy and local privacy laws and are not a universal mandate for all terminations.

D. The security manager must be notified in writing prior to termination

While the security manager must be notified to execute the revocation of physical and logical access, this notification is part of the formal process that is initiated and managed by HR.

1. PCI Security Standards Council, "PCI Card Production and Provisioning Physical Security Requirements, Version 3.0," November 2020.

Section 3.4, Requirement 3.4.1: "The entity must have a formal process for terminating personnel." This requirement establishes the need for a structured, official procedure, which is fundamentally managed by an HR department in a corporate setting.

2. Noe, R. A., Hollenbeck, J. R., Gerhart, B., & Wright, P. M. (2019). Fundamentals of Human Resource Management (8th ed.). McGraw-Hill Education.

Chapter 12, "Separating and Retaining Employees": This chapter details the role of HR in managing employee separations, including involuntary turnover (termination). It emphasizes that HR's role is to ensure the process is fair, legally defensible, and handled with dignity, highlighting HR's central function in any formal termination.

3. Cornell University, ILR School. "HR Management and Compliance: Terminating the Employment Relationship."

Course materials and publications from this institution consistently describe the termination process as a core HR function. They outline the necessary steps, including documentation, legal review, and coordination with other departments, establishing that HR must be notified to initiate a formal, compliant termination.