PCI DSS v4.0/Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know/109 of 250
7.3.3Access to system components and data is managed via an access control system(s)
Control family: Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know
Control description
Defined Approach Requirements:
The access control system(s) is set to "deny all" by default.
Defined Approach Testing Procedures:
7.3.3 Examine vendor documentation and system settings to verify that the access control system(s) is set to "deny all" by default.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.