Which measure best satisfies PCI DSS requirement to limit and monitor physical access to systems in the cardholder data environment?

• A. Access is allowed to any employee with a general password, no physical controls required.
• B. Physical access controls are not necessary if network perimeter is secured.
• C. All access must be logged in a centralized IT ticketing system.
• D. Access to computer rooms and data centers is controlled with badge readers or other devices including authorized badges and lock and key.

Answer: (D)

Limiting and monitoring physical access to the cardholder data environment is required. PCI DSS expects controls that physically restrict who can enter areas that store, process, or transmit cardholder data and to keep an auditable record of those who do enter. Using badge readers or similar devices with authorized badges, plus locks, directly enforces who has access and provides verifiable evidence of entry, which meets both restricting and monitoring needs.

Other approaches fall short because a simple password with no physical protections leaves critical areas unprotected from tampering or theft; securing the network perimeter does not remove the necessity to physically protect CHD areas; and logging access in a ticketing system, while useful for monitoring, does not by itself prevent unauthorized physical entry.