The Payment Card Industry Data Security Standard (PCI DSS) con ai s six different categories of control objectives. Each objective contains one or more requirements, which must be followed in order to

Regularly testing security systems and processes corresponds to PCI DSS Requirement 11, which falls under the 'Regularly Monitor and Test Networks' objective, not access control.

Encrypting cardholder data transmission over public networks is PCI DSS Requirement 4, which falls under the 'Protect Cardholder Data' objective.

Assigning a unique ID to each person with computer access maps directly to PCI DSS Requirement 8 (Identify and Authenticate Access to System Components), which is explicitly listed under the 'Implement Strong Access Control Measures' objective. Unique user identification ensures individual accountability and prevents shared credentials from obscuring audit trails. This is a foundational access control mechanism that cannot be substituted by the other listed controls for this specific objective.

Using and regularly updating anti-virus software is PCI DSS Requirement 5, which falls under the 'Maintain a Vulnerability Management Program' objective.