Implement Strong Access Control Measures
7
Restrict Access to System Components and Cardholder Data by Business Need to Know
Access to cardholder data and CDE systems must be restricted to only those individuals whose job responsibilities require it. Access control systems must enforce least privilege, deny access by default, and be documented with a formal access control model that covers all system components.
Control Intent
Ensure that only authorised personnel can access system components and cardholder data, with access limited to the minimum necessary for their job function, enforced through documented access control policies and technical mechanisms.
Common Failures
- Excessive privileges granted to users beyond their job requirements, violating least privilege
- No formal access control policy or role-based access model documented
- Failure to conduct regular (six-monthly) access reviews, leading to orphaned accounts with active privileges
- Application service accounts granted excessive database privileges rather than minimum required access
- Shared accounts used for administrative access, preventing individual accountability