Which practice is required for visitors in areas where cardholder data is processed?

• A. Visitors can roam freely with a generic badge
• B. Visitors must be authorized before entering and escorted at all times
• C. Visitors may not be identified
• D. Visitors are never allowed unattended

Answer: (B)

Access to areas where cardholder data is processed must be tightly controlled. Visitors should be authorized before entering and escorted at all times to ensure that only approved individuals are present and that a security professional is always aware of who is in the sensitive space and what they might access. This combination reduces the risk of unauthorized viewing, tampering, or data exposure and creates an auditable trail of who was present and when.

Choosing a generic badge with free roaming undermines the access controls and makes it easy for someone to enter unverified. Not being able to identify visitors eliminates accountability, making it impossible to track who interacted with sensitive data. While strict escorting is important, it is not sufficient on its own without prior authorization to enter the restricted area.