When must HSA motion detectors generate an alarm event?

For High-Security Areas (HSAs), the PCI Card Production and Provisioning Security Requirements mandate the integration of multiple physical security controls to ensure a high level of assurance. Motion detectors must be correlated with the access-control system. An alarm event is required only when motion is detected without a corresponding authorized entry being registered by the access-control system (i.e., the system indicates the room is unoccupied). This logic prevents a high volume of false alarms during legitimate, authorized access while ensuring that any unauthorized presence immediately triggers a security response. This integrated approach is a fundamental principle for securing sensitive environments.

A. This would generate excessive false alarms during normal, authorized activities, rendering the system ineffective due to alarm fatigue.

B. Security for an HSA must be active 24/7, as authorized access may be required at any time, not just during "regular business hours."

C. This is the inverse of the correct security logic; it would incorrectly generate alarms for authorized individuals who have legitimately entered the area.

1. PCI Security Standards Council, "PCI Card Production and Provisioning Security Requirements v3.0," May 2020.

Annex A1: HSA Physical Security Requirements, Requirement A1.1.3: "Intrusion-detection systems must be implemented and active 24/7 to detect unauthorized entry into the HSA. Alarms must be generated when motion is detected and the access-control system indicates the room is not occupied." This directly supports the correct answer.

2. Garcia, M. L., "The Design and Evaluation of Physical Protection Systems, 2nd Edition," Butterworth-Heinemann, 2012.

Chapter 5: Detection and Assessment: This academic text on physical security explains the principle of sensor data correlation. It details how effective intrusion detection systems integrate sensor inputs (like motion) with access control data to reduce nuisance alarms and improve the probability of detecting genuine intrusions. An alarm state is triggered by an anomaly, such as presence without authorization. (pp. 115-118).