PCI DSS v4.0/Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know/105 of 250
7.2.5.1Access to system components and data is appropriately defined and assigned
Control family: Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know
Control description
Defined Approach Requirements:
All access by application and system accounts and related access privileges are reviewed as follows:
- Periodically (at the frequency defined in the entity's targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1).
- The application/system access remains appropriate for the function being performed.
- Any inappropriate access is addressed.
- Management acknowledges that access remains appropriate.
Defined Approach Testing Procedures:
7.2.5.1.a Examine policies and procedures to verify they define processes to review all application and system accounts and related access privileges in accordance with all elements specified in this requirement.
7.2.5.1.b Examine the entity's targeted risk analysis for the frequency of periodic reviews of application and system accounts and related access privileges to verify the risk analysis was performed in accordance with all elements specified in Requirement 12.3.1.
7.2.5.1.c Interview responsible personnel and examine documented results of periodic reviews of system and application accounts and related privileges to verify that the reviews occur in accordance with all elements specified in this requirement.