Payment Card Industry (PCI) Data Security Standards Practice Test

Which of the following is required for the implementation of strong access control measures?

1. Unique user identification

2. Shared accounts

3. Frequent password changes

4. Direct access to all cardholder data

The correct answer is: Unique user identification

The implementation of strong access control measures necessitates unique user identification. This requirement ensures that each individual accessing sensitive data, such as cardholder information, can be distinctly identified. Unique user identification plays a critical role in providing accountability, as it allows organizations to track user activity, enforce security policies, and quickly respond to security incidents. By having a unique identifier for each user, organizations can effectively manage access rights based on an individual's role within the company, minimizing the risk of unauthorized access. This measure is fundamental to maintaining a secure environment where sensitive information is handled responsibly. In contrast, shared accounts could compromise security, as it becomes challenging to pinpoint which individual performed specific actions. Frequent password changes, while important, are not as foundational as unique identification. Direct access to all cardholder data would violate principles of least privilege, which emphasize that users should only have access to the data necessary for their job responsibilities.