Which statement accurately describes the requirement for the device list in 9.9.1?

Which statement accurately describes the requirement for the device list in 9.9.1?

• A. Make, model, location, and serial number
• B. Make and model are the only required details
• C. Location is the only required detail
• D. Serial number is the only required detail

Answer: (D)

Maintaining an accurate device list in the cardholder data environment hinges on uniquely identifying each device. The serial number serves as that unique identifier, so the requirement specifies including the serial number on the device list. Other details like make/model or location can be helpful for asset management, but they are not required by this specific requirement. The essential point is to have a current list where every device can be distinguished by its serial number, enabling clear tracking and incident response.

Maintaining an accurate device list in the cardholder data environment hinges on uniquely identifying each device. The serial number serves as that unique identifier, so the requirement specifies including the serial number on the device list. Other details like make/model or location can be helpful for asset management, but they are not required by this specific requirement. The essential point is to have a current list where every device can be distinguished by its serial number, enabling clear tracking and incident response.