7.1.1Processes and mechanisms for restricting access to system components and cardholder data by business need to know are defined and understood

Defined Approach Requirements:

All security policies and operational procedures that are identified in Requirement 7 are:

- Documented.

- Kept up to date.

- In use.

-Known to all affected parties.

Defined Approach Testing Procedures:

7.1.1 Examine documentation and interview personnel to verify that security policies and operational procedures identified in Requirement 7 are managed in accordance with all elements specified in this requirement.