PCI DSS v4.0/Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know/103 of 250
7.2.4Access to system components and data is appropriately defined and assigned
Control family: Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know
Control description
Defined Approach Requirements:
All user accounts and related access privileges, including third-party/vendor accounts, are reviewed as follows:
- At least once every six months.
- To ensure user accounts and access remain appropriate based on job function.
- Any inappropriate access is addressed.
- Management acknowledges that access remains appropriate.
Defined Approach Testing Procedures:
7.2.4.a Examine policies and procedures to verify they define processes to review all user accounts and related access privileges, including third-party/vendor accounts, in accordance with all elements specified in this requirement.
7.2.4.b Interview responsible personnel and examine documented results of periodic reviews of user accounts to verify that all the results are in accordance with all elements specified in this requirement.