Which of the following controls does the PCI DSS framework NOT require?

Which of the following controls does the PCI DSS framework NOT require?
A . Implement strong asset control protocols.
B . Implement strong access control measures.
C . Maintain an information security policy.
D . Maintain a vulnerability management program.

Answer: A