What statement accurately describes the requirement for security policies and procedures related to monitoring access to network resources and cardholder data?

• A. Security policies and operational procedures for monitoring all access to network resources and cardholder data are documented, in use, and known to all affected parties.
• B. Security guidelines do not need to be documented.
• C. Only IT staff must know the procedures.
• D. Procedures can be informal and not shared.

Answer: (A)

The concept being tested is that security policies and procedures for monitoring access to network resources and cardholder data must be formal, actionable, and widely communicated. When these policies are documented, put into use, and known by everyone affected, there is a clear standard everyone can follow, which makes monitoring consistent, enforceable, and auditable.

That’s why the correct statement is that security policies and operational procedures for monitoring all access to network resources and cardholder data are documented, in use, and known to all affected parties. Documentation provides the official rules and steps; having them in use ensures they aren’t just paperwork but are applied in daily operations; and making sure all affected parties know them guarantees awareness, accountability, and proper training.

Why the other ideas don’t fit: guidelines that aren’t documented can’t be reliably enforced or audited, so there’s no verifiable standard. If only IT staff know the procedures, other personnel aren’t aware of expectations, breaking accountability and risk management. And if procedures are informal and not shared, there’s no consistent practice, no training, and no way to demonstrate compliance.