Which baseline setting should an access control system enforce by default to protect cardholder data?

Which baseline setting should an access control system enforce by default to protect cardholder data?

• A. Deny all unless specifically allowed
• B. Allow all by default
• C. Deny all external access and allow internal
• D. Grant access to all system components

Answer: (A)

Starting with a deny-by-default posture is the safest way to control access to cardholder data. By not allowing anything unless there is a specific, reviewed authorization, you minimize the risk of accidental or malicious access slipping through. This aligns with the principle of least privilege: people and systems only get access to what they absolutely need to perform their job, and nothing more. In PCI DSS terms, access to cardholder data must be restricted to authorized personnel with properly enforced authentication and authorization, and every access should be auditable. If access were allowed by default, or if internal access was treated differently from external without explicit controls, the attack surface would be much larger and harder to manage. Granting access to all system components also contradicts least privilege and significantly increases risk. By contrast, granting access only through explicit, justified rules keeps controls tight and makes it easier to review, revoke, and monitor permissions.

Starting with a deny-by-default posture is the safest way to control access to cardholder data. By not allowing anything unless there is a specific, reviewed authorization, you minimize the risk of accidental or malicious access slipping through. This aligns with the principle of least privilege: people and systems only get access to what they absolutely need to perform their job, and nothing more. In PCI DSS terms, access to cardholder data must be restricted to authorized personnel with properly enforced authentication and authorization, and every access should be auditable.

If access were allowed by default, or if internal access was treated differently from external without explicit controls, the attack surface would be much larger and harder to manage. Granting access to all system components also contradicts least privilege and significantly increases risk. By contrast, granting access only through explicit, justified rules keeps controls tight and makes it easier to review, revoke, and monitor permissions.