PCI DSS v4.0/Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know/101 of 250
7.2.2Access to system components and data is appropriately defined and assigned
Control family: Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know
Control description
Defined Approach Requirements:
Access is assigned to users, including privileged users, based on:
- Job classification and function.
- Least privileges necessary to perform job responsibilities.
Defined Approach Testing Procedures:
7.2.2.a Examine policies and procedures to verify they cover assigning access to users in accordance with all elements specified in this requirement.
7.2.2.b Examine user access settings, including for privileged users, and interview responsible management personnel to verify that privileges assigned are in accordance with all elements specified in this requirement.
7.2.2.c Interview personnel responsible for assigning access to verify that privileged user access is assigned in accordance with all elements specified in this requirement.