The 12.3 requirement focuses on developing usage policies for what?

• A. Financial records
• B. Critical technologies
• C. Marketing content
• D. Employee vacation

Answer: (B)

This item tests governance around how people use the systems that are essential to protecting cardholder data. The idea behind this requirement is to establish formal usage policies for critical technologies—those systems and devices that, if misused or misconfigured, could expose sensitive payment information. By defining acceptable use, access controls, configuration and maintenance rules, and clear responsibilities, organizations reduce the risk that vital components (like servers, network equipment, encryption keys, or payment applications) are mishandled or left unsecured. Without these policies, even well-trained staff might operate these technologies in unsafe ways, increasing exposure of cardholder data. The other topics listed—financial records, marketing content, or employee vacation—do not pertain to controlling the use of technologies that handle or protect cardholder data, which is why they aren’t the focus of this requirement.