PCI DSS v4.0/Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know/100 of 250
7.2.1Access to system components and data is appropriately defined and assigned
Control family: Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know
Control description
Defined Approach Requirements:
An access control model is defined and includes granting access as follows:
- Appropriate access depends on the entity's business and access needs.
- Access to system components and data resources that is based on users' job classification and functions.
- The least privileges are required (for example, user, administrator) to perform a job function.
Defined Approach Testing Procedures:
7.2.1.a Examine documented policies and procedures and interview personnel to verify the access control model is defined in accordance with all elements specified in this requirement.
7.2.1.b Examine access control model settings and verify that access needs are appropriately defined in accordance with all elements specified in this requirement.