PCI DSS v4.0/Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know/106 of 250
7.2.6Access to system components and data is appropriately defined and assigned
Control family: Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know
Control description
Defined Approach Requirements:
All user access to query repositories of stored cardholder data is restricted as follows:
- Via applications or other programmatic methods, with access and allowed actions based on user roles and least privileges.
- Only the responsible administrator(s) can directly access or query the repositories of stored CHD.
Defined Approach Testing Procedures:
7.2.6.a Examine policies and procedures and interview personnel to verify processes are defined for granting user access to query repositories of stored cardholder data, in accordance with all elements specified in this requirement.
7.2.6.b Examine configuration settings for querying repositories of stored cardholder data to verify they are in accordance with all elements specified in this requirement.