Which setting should be verified to ensure restricted access by default?

• A. Confirm that the default is to allow access to most users
• B. Confirm that access control systems are disabled by default
• C. Confirm that the default is to allow access during business hours only
• D. Confirm that the default setting is deny-all

Answer: (D)

Limiting access by default uses a deny-by-default mindset, granting permissions only when explicitly approved. This creates a secure baseline where no one gets access unless there’s a deliberate, reviewed authorization, reducing the chance of unintended or excessive permissions.

In PCI DSS terms, access must be tightly controlled to cardholder data, following the principle of least privilege. A deny-all default ensures every access path is questioned and justified, with clear records of who was granted access and why, making audits and security monitoring more effective.

Practically, this means system configurations start with no access and only add exceptions after proper review, logging, and approval. Allowing access by default, disabling controls, or constraining access only by time still leaves gaps or weak protections. Only a deny-all default truly enforces restricted access by default.