Which statement best describes the scope of procedures for user identification management?

Which statement best describes the scope of procedures for user identification management?

• A. Procedures should only cover consumer users
• B. Review procedures only for password policies
• C. Confirm that procedures cover unique ID assignment, credential handling, and revocation for all users and administrators
• D. Procedures should apply only to non-privileged users

Answer: (C)

The main idea here is that procedures for identifying and authenticating users must cover everyone who accesses the systems, not just a subset. This means assigning a unique ID to each person, handling their credentials securely, and revoking access when it’s no longer allowed, for all users and for administrators as well. This full lifecycle ensures accountability and proper control over who can reach sensitive data, which is essential for PCI DSS. Limiting scope to consumer users misses privileged accounts that carry higher risk, which is why that alone isn’t sufficient. Focusing only on password policies ignores the broader process of how credentials are issued, managed, and revoked. Applying procedures only to non-privileged users omits administrators and other elevated-access accounts, which require strict control and timely revocation.

The main idea here is that procedures for identifying and authenticating users must cover everyone who accesses the systems, not just a subset. This means assigning a unique ID to each person, handling their credentials securely, and revoking access when it’s no longer allowed, for all users and for administrators as well. This full lifecycle ensures accountability and proper control over who can reach sensitive data, which is essential for PCI DSS.

Limiting scope to consumer users misses privileged accounts that carry higher risk, which is why that alone isn’t sufficient. Focusing only on password policies ignores the broader process of how credentials are issued, managed, and revoked. Applying procedures only to non-privileged users omits administrators and other elevated-access accounts, which require strict control and timely revocation.