12.3.4 requires?

12.3.4 requires?

• A. A method to accurately and readily determine owner, contact information, and purpose
• B. A list of company-approved products
• C. Acceptable network locations for the technologies
• D. Authentication for use of the technology

Answer: (A)

Asset ownership and clear accountability for assets in the cardholder data environment is what this item tests. The best choice describes establishing a method to identify who owns each asset, how to reach that owner, and the asset’s purpose. This information is essential for governance, change management, and incident response because you know who is responsible, who to contact for issues, and why the asset exists in the environment. Without it, coordinating fixes, updates, or policy enforcement becomes inefficient and error‑prone. The other options don’t fit because they address different needs: a list of company-approved products relates to approved software but not ownership or purpose; specifying acceptable network locations concerns network architecture or segmentation rather than asset accountability; and authentication for use of the technology focuses on access control rather than who is responsible for the asset and its role.

Asset ownership and clear accountability for assets in the cardholder data environment is what this item tests. The best choice describes establishing a method to identify who owns each asset, how to reach that owner, and the asset’s purpose. This information is essential for governance, change management, and incident response because you know who is responsible, who to contact for issues, and why the asset exists in the environment. Without it, coordinating fixes, updates, or policy enforcement becomes inefficient and error‑prone.

The other options don’t fit because they address different needs: a list of company-approved products relates to approved software but not ownership or purpose; specifying acceptable network locations concerns network architecture or segmentation rather than asset accountability; and authentication for use of the technology focuses on access control rather than who is responsible for the asset and its role.