PCI DSS Requirement 12.

PCI DSS Requirement 12.7 mandates that organizations perform background checks on personnel who have access to the cardholder data environment (CDE) to ensure that individuals with malicious intent do not gain access to sensitive cardholder data.​

Option A:Incorrect. While conducting background checks on all personnel is a good security practice, PCI DSS specifically requires checks for those with access to the CDE.​

Option B:Correct. Background checks are required for personnel with access to the CDE to mitigate the risk of insider threats.​

Option C:Incorrect. Visitors are not typically subjected to background checks but should be escorted and monitored while in sensitive areas.