Which PCI DSS requirement focuses on identifying and authenticating access to system components?

• A. Requirement 3
• B. Requirement 5
• C. Requirement 8
• D. Requirement 12

Answer: (C)

Identifying who can access system components and proving their identity before access is granted is fundamental to securing the cardholder data environment. This requirement focuses precisely on ensuring that every person or component with access has a unique identifier and undergoes proper authentication. By enforcing unique IDs, strong authentication methods, and, for remote or elevated access, multi-factor authentication, it creates accountability and prevents unauthorized entry. Promptly revoking access when roles change or employment ends keeps the environment protected as people’s responsibilities shift. In short, this control gates access to the systems themselves, which is why it’s the best fit for the question. Other areas focus on protecting the data once it's stored or in transit, or on overarching security program practices, rather than the specific process of identifying and authenticating access to system components.