Under PCI DSS, what is the minimum requirement for authenticating users with access to cardholder data environments?
-
A
Single-factor authentication is sufficient for all users
-
B
Multi-factor authentication is required for all non-console administrative access
-
C
Biometric authentication must be used as the primary factor
-
D
Password-only authentication is acceptable if passwords are changed monthly