Which of the following is included in 10.2.5 regarding account management?

• A. Creation of new accounts and elevation of privileges, and all changes to root/administrative accounts.
• B. Only password resets.
• C. Only changes to user roles without creating accounts.
• D. Only login attempts by administrators.

Answer: (A)

Account management events are a key part of auditing access to systems. PCI DSS requires automated audit trails that capture actions that change who has access and at what level, especially for high-privilege accounts. This means logging when new accounts are created, when privileges are elevated, and when changes are made to root or administrative accounts. Tracking these actions provides accountability and helps detect inappropriate provisioning or privilege abuse.

Other options are too narrow: password resets, only changes to user roles without creating accounts, or only login attempts by administrators don’t monitor the actions that actually grant, remove, or raise access, which is essential for proving that access is properly controlled and monitored.