7.2 Access is appropriately defined and assigned
How to meet it
Assign access by role and need-to-know, with documented approval.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 7.2, in plain English.
7.2.1An access control model is defined that grants access by business need, job function, and least privilege.
7.2.2Access is assigned by job classification and function, granting only the least privileges needed.
7.2.3Required privileges are approved by authorized personnel before being granted.
7.2.4All user accounts and privileges, including third-party, are reviewed at least every six months and confirmed by management.
7.2.5Application and system accounts are assigned least privileges, limited to what the system genuinely needs.
7.2.5.1Application/system account access is reviewed periodically at a frequency set by the targeted risk analysis.
7.2.6User access to query repositories of stored cardholder data is restricted via applications, roles, and least privilege.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Information security roles and responsibilitiesUse for ISO 27001 A.5.2, A.5.3 and A.5.4, defining security roles, segregation of duties, management responsibilities, and SOC 2 organisational controls.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.
Open the control-to-policy map← 7.1 Processes and mechanisms are defined and understood7.3 Access is managed via an access control system →
Back to Requirement 7, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.