Which action best supports verification of user identification management procedures?

• A. Implement a generic, shared ID policy for all users
• B. Review procedures and confirm they define processes for user identification management
• C. Allow casual access if the user appears trustworthy
• D. Rely on password complexity guidelines only

Answer: (B)

Verification of user identification management procedures focuses on whether there are formal, documented processes for how user identities are created, maintained, and terminated, and how access is granted, updated, and revoked. The best action is to review the procedures and confirm they define these processes for user identification management. This ensures there is clear governance, accountability, and a repeatable, auditable approach to provisioning and deprovisioning access, which is essential for reliably identifying and authenticating users in accordance with PCI DSS.

Relying on a generic, shared ID policy undermines accountability and violates the need for unique user IDs. Allowing casual access based on trust bypasses necessary controls. Relying only on password complexity ignores the broader lifecycle of identity management, including provisioning, deprovisioning, and access reviews that are critical to maintaining proper control over who has access to systems.