Payment Card Industry (PCI) Data Security Standards Practice Test

What should be included in an organization's procedures for managing visitors?

1. Visitors are escorted at all times within areas where cardholder data is processed or maintained

2. Visitor badges are identical to badges used by onsite personnel

3. Visitor log includes visitor name, address, and contact phone number

4. Visitors retain their identification (for example, a visitor badge) for 30 days after completion of the visit

The correct answer is: Visitors are escorted at all times within areas where cardholder data is processed or maintained

The correct answer highlights an essential security control in the context of managing visitors within areas where cardholder data is processed or maintained. By requiring that visitors are escorted at all times, an organization significantly reduces the risk of unauthorized access to sensitive data. This measure ensures that visitors do not stray into areas where they could potentially compromise cardholder information, whether intentionally or accidentally. Escorting visitors is a critical part of maintaining the integrity of physical security. It allows for continuous monitoring of their activities and minimizes the chance of distractions that could lead to data breaches or security incidents. This protocol reflects a commitment to protecting cardholder data in accordance with PCI Data Security Standards, which emphasize the importance of physical security measures in safeguarding sensitive information. In contrast to this correct approach, the other options might not contribute as effectively to ensuring the security of sensitive data. For instance, having visitor badges that are identical to those used by onsite personnel could lead to confusion and make it easier for unauthorized individuals to blend in. A visitor log that includes excessive personal information, such as home addresses, may also create additional privacy concerns without adding significant security benefits. Lastly, allowing visitors to retain identification for an extended period might pose security risks if such identifiers are misused after the visit. Each of these aspects