What should PCI DSS require to distinguish onsite personnel from visitors?

• A. No distinction is necessary; anyone can enter with a generic badge.
• B. Visitors can access sensitive areas without escort
• C. Procedures to identify onsite personnel and visitors, including assigning badges, changing access requirements, and revoking expired IDs.
• D. Only a sign-in sheet without badges

Answer: (C)

Distinguishing onsite personnel from visitors through formal identification and access controls is fundamental to physical security around the cardholder data environment. A solid program isn’t just about having people sign in; it’s about ensuring each person has a clearly defined role and authorization, and that this authorization is visible, managed, and revocable.

The best choice describes a complete process: procedures to identify both onsite personnel and visitors, assigning badges that reflect their access rights, adjusting those rights when roles or statuses change, and revoking IDs when they expire or are no longer valid. This creates a traceable, time‑bound system where only authorized individuals can reach sensitive areas, and where departures or changes in responsibility promptly remove access. It supports monitoring, accountability, and rapid response to potential security issues.

In contrast, simply having no distinction between personnel and visitors invites untracked access; allowing visitors into sensitive areas without escort bypasses important safeguards that ensure oversight and control; and relying only on a sign‑in sheet provides minimal proof of authorization and does not enforce ongoing access control or revocation.