Which statement accurately reflects the responsibility for monitoring and controlling all access to data?

• A. It is the responsibility of the information security management
• B. It is not required
• C. It is handled by external auditors
• D. It is the responsibility of the IT help desk

Answer: (A)

The key idea is that information security management owns the authority and accountability for access control. They establish and enforce the policies that determine who can access data, under what conditions, and what level of access is appropriate. This includes creating and maintaining access control procedures, provisioning and revoking user access, enforcing least-privilege, and monitoring access activity through logs and authentication controls. External auditors assess and verify that these controls exist and are effective, but they do not bear day-to-day ownership of the controls. The IT help desk might perform routine tasks like password resets or access provisioning requests, but the overarching responsibility to monitor and control access rests with information security management. The option that access control isn’t required is incorrect, since PCI DSS requires strict access controls to protect cardholder data.