When defining access needs for each role, what should be included?

• A. System components and data resources that each role needs to access, and the ID of privileges necessary
• B. Only the system components without any privilege data
• C. Employee's personal preferences
• D. Department budget data

Answer: (A)

Defining access needs per role means listing exactly which system components and data resources the role must access to do the job, and tying that to the specific privileges required (the privilege IDs or permission names). This creates a clear, auditable map of what a user can do and access, which supports the least-privilege and need-to-know principles that PCI DSS requires. For example, a payment processing role would include access to the order processing system and relevant customer data, with the exact privileges needed (such as read or update)—no more, no less. Personal preferences and department budgets aren’t relevant to access rights, and simply listing components without the associated privileges leaves the access level undefined and can lead to over- or under-privilege.