How should physical authentication methods be handled when access is no longer needed?

• A. They should be copied for backup in a secure location
• B. They should be returned or deactivated
• C. They should be kept active for emergencies
• D. They should be reassigned to another user immediately

Answer: (B)

When access is no longer needed, physical authentication credentials should be returned or deactivated. This prevents former users from entering secure areas or systems after their role ends, closing a potential gap that could be exploited. It’s a core part of controlling physical access and is reinforced in PCI DSS by ensuring timely deprovisioning of access to the cardholder data environment. In practice, organizations revoke the credential in access control systems, collect badges or keys, and reissue or reassign credentials only after proper adjustment of permissions. Copying credentials for backup creates an unnecessary risk of loss or misuse; keeping them active for emergencies leaves a door open to unauthorized entry; reassigning them to another user without deactivation can cause lingering access tied to the old credentials. Returning or deactivating the credentials cleanly eliminates these risks.