What is the goal of restricting access to cardholder data?

• A. To maximize reporting capabilities.
• B. To minimize operational costs.
• C. To ensure all staff can access payment data.
• D. To limit access to as few individuals as possible based on business need-to-know.

Answer: (D)

The main idea is to protect sensitive payment data by applying the principle of least privilege: only the people who truly need access to cardholder data to do their jobs should have it. By restricting access to as few individuals as possible based on a business need-to-know, you dramatically reduce the risk of accidental exposure or malicious misuse, and you make it easier to monitor and audit who touched the data. This approach is central to securing cardholder information and aligns with payment standards like PCI DSS.

The other options miss the point. Broad access would increase risk, not reduce it; aiming to maximize reporting capabilities isn’t the goal of data protection, and pursuing minimal cost by limiting access can undermine security.