What should security policies and procedures for restricting access to cardholder data be?

• A. Documented, in use, and known to all affected parties
• B. Reserved for IT staff only
• C. Optional and not widely communicated
• D. Reviewed annually but not distributed

Answer: (A)

Access control for cardholder data works best when the policy is formal, actively followed, and shared with everyone who must comply. When policies are documented, there’s a clear standard that can be reviewed and audited. Keeping them in use means the procedures aren’t just words on a page but are implemented in day-to-day operations, reducing gaps in how access is granted or restricted. Making the policy known to all affected parties ensures that users, managers, and IT staff understand their responsibilities and know how to act, which supports consistent enforcement and accountability.

If policies were only for IT staff, non-IT personnel might not follow the required controls. If they’re optional or not widely communicated, people won’t apply them consistently. If they’re reviewed annually but not distributed, people won’t be aware of changes, leading to outdated practices and increased risk.