7.3 Access is managed via an access control system
How to meet it
Enforce access through a system set to deny-all by default.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 7.3, in plain English.
7.3.1An access control system limits access based on need-to-know and covers all system components.
7.3.2The access control system enforces permissions assigned by job classification and function.
7.3.3The access control system defaults to deny all unless a rule explicitly grants access.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Information classification and handling policyUse for ISO 27001 A.5.12, A.5.13, A.5.14, privacy, SOC 2 Confidentiality, and data handling controls.Physical and environmental security policyUse for ISO 27001 A.7.1 to A.7.14, SOC 2 Security, and PCI DSS requirement 9 physical access controls.Human resources security policyUse for ISO 27001 A.6.1 to A.6.6, A.6.8, SOC 2 Security, and personnel security controls.
Open the control-to-policy mapBack to Requirement 7, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.