When using authentication mechanisms such as tokens or smart cards, how should they be assigned?

• A. Tokens Can Be Shared Among Accounts
• B. Authentication Mechanisms Must Be Assigned To An Individual Account And Controls Ensure Only Intended Account Can Use
• C. Tokens May Be Issued To Groups
• D. Access Via Tokens Is Optional

Answer: (B)

The key idea is that authentication mechanisms like tokens or smart cards must be tightly bound to a single user account so only that user can use them. This preserves accountability and traceability—every action can be attributed to a specific person, which is essential for auditing and enforcing access controls. If a token were shared among multiple accounts or issued to a group, you’d lose the ability to know who actually performed actions, increasing risk and undermining PCI DSS requirements. Making token-based access optional would weaken security, as strong authentication would not be consistently enforced. So, assigning the mechanism to an individual account with controls to ensure only that account can use it is the correct approach.