Who may view full PAN displays according to masking policy?

• A. All users with display access
• B. Users with documented legitimate business need
• C. Anyone who logs in
• D. Only system administrators

Answer: (B)

Masking PANs is about protecting cardholder data by exposing the minimum necessary. The question tests who is allowed to view the full PAN when a masking policy is in place. Under PCI DSS practice, access to the full PAN is restricted to individuals who have a documented legitimate business need for that access, and this need must be approved and auditable. This approach follows the principle of least privilege and need-to-know, reducing exposure to sensitive data while still enabling authorized tasks to be performed.

Viewing the full PAN should not be granted to all users with login access or to anyone who logs in, and it should not be limited only to system administrators. These broader access patterns would unnecessarily widen exposure or be too restrictive for day-to-day operations. The key idea is that only those with a clearly justified, officially approved business reason may see the full PAN, and their access is typically monitored and reviewed.