Cardholder data and card systems should only be accessible to those that need that information to do their jobs. Once you’ve implemented access privileges, make sure to document it.
Quick Answer:
What does PCI DSS Requirement 7 require for access control?
PCI DSS Requirement 7 requires restricting access to cardholder data and card systems to only those employees who need it for their job function, using documented role-based access privileges.
- This is one of the oldest and most basic PCI DSS requirements, yet many organizations still don't fully implement accurate role-based access.
- Every implemented access privilege must be documented, not just configured, to demonstrate compliance during an assessment.
- PCI DSS v4.0 raises expectations here, requiring more frequent reviews of user accounts, system accounts, and their associated access privileges.
- The underlying principle mirrors the "minimum necessary" concept used in HIPAA: access should be granted strictly by job need, not convenience.
*This article was taken from our PCI Guide. For more information on this topic, download our free PCI Guide.
This requirement is one of the oldest and most basic parts of the PCI DSS (and data security in general).
There’s no new trend or solution. But not all organizations accurately comply with this requirement or have even tried role-based access at all.
This is all you need to know: don’t give access to people who don’t need it. Cardholder data and card systems should only be accessible to those that need that information to do their jobs. Once you’ve implemented access privileges, make sure to document it.
Cardholder data and card systems should only be accessible to those that need that information to do their jobs.
PCI DSS v4.0 Considerations for Requirement 7
PCI DSS 4.0 raises the expectations of managing user accounts, system accounts, and access privileges. More frequent reviews are required. Prepare for the new requirements by thoroughly documenting all accounts and related access privileges.
Related Posts
.svg)