In which of the following locations must the CCTV and access control servers be located?

The PCI Card Production and Provisioning Physical Security Standard mandates that the servers hosting the CCTV and access control systems, which are critical to the facility's security posture, must be protected from unauthorized access and tampering. The standard provides two acceptable options for their location: either within the Security Control Room (SCR) itself or in a separate room. If a separate room is used, it must be fortified with security controls that are equivalent to those required for the SCR, ensuring the same high level of protection is maintained for this critical infrastructure.

A. This option is too restrictive. The standard explicitly allows for an alternative location outside the SCR, provided it has equivalent security.

B. This is less precise. While the room would likely be in the High-Security Area (HSA), the core requirement is security equivalence to the SCR, which is the more specific and critical control.

D. A generic "secure server room" may not meet the specific, stringent access control and monitoring requirements mandated for an SCR, making this option insufficient.

1. PCI Security Standards Council, "PCI Card Production and Provisioning Physical Security Standard, Version 3.0", May 2022. Requirement 3.4, Page 21. "The servers for the CCTV and access control systems must be located within the SCR or a room with equivalent security controls applied."