7.1 Access restriction processes and roles
Requirement 7.1 asks for current policies and procedures for restricting access by business need to know, and documented roles for granting, reviewing and revoking access.
Requirement 7 Restrict access by need to know
Requirement 7 covers least-privilege access by business need to know, access reviews and access control systems. Each page covers one second-level requirement.
7.2 Defining and assigning access
Requirement 7.2 defines and assigns access on least privilege: an access control model, approved privileges, six-monthly user access reviews, least privilege and periodic reviews for system accounts, and restricted query access to cardholder data stores.
7.3 Access control systems
Requirement 7.3 requires the technical access control systems that enforce need-to-know access, covering all system components, enforcing permissions by job function, and set to deny all by default.
