What must be in place to authorize visitors?

• A. Visitors may enter unrestricted
• B. Visitor authorization and access controls per PCI DSS requirements
• C. Visitors must present a government ID but no authorization process
• D. Visitors are allowed after-hours only

Answer: (B)

To protect cardholder data, you need a formal process that authorizes visitors and controls their access to facilities and the cardholder data environment. This means before anyone can enter secure areas, there is documented authorization, identity verification, and assignment of access rights based on the visitor’s purpose. Visitors should be signed in and out, potentially escorted, and their access should be logged and revocable. These measures ensure only authorized individuals can reach sensitive areas and align with PCI DSS requirements for physical access control. A government ID alone is not enough to authorize entry, and after-hours access still requires proper authorization and controls.