PCI DSS v4.0/Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know/102 of 250
7.2.3Access to system components and data is appropriately defined and assigned
Control family: Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know
Control description
Defined Approach Requirements:
Required privileges are approved by authorized personnel.
Defined Approach Testing Procedures:
7.2.3.a Examine policies and procedures to verify that they define processes for approval of all privileges by authorized personnel.
7.2.3.b Examine user IDs and assigned privileges, and compare with documented approvals to verify that:
- Documented approval exists for the assigned privileges.
- The approval was by authorized personnel.
-Specified privileges match the roles assigned to the individual.