Requirement 7: Restrict Access to System Components and Cardholder Data by Business Need to Know
Defines "access," "access rights," "privileges," "need to know," and "least privileges."
Tracking the access rights of many users can be a very difficult task to manage. Role-based access controls (RBAC) help to make this task more manageable.
Employee roles should be identified and assigned in an effort to determine which individuals require access to cardholder data or systems in the cardholder data environment. RBAC should be assigned appropriately so that each individual has access to only the systems and resources needed to perform their job function. Individuals should be assigned to roles, and roles should be assigned access rights (as opposed to assigning access rights directly to users). All other access to cardholder data and CDE systems must be denied. Documented approval must be maintained for all individual role assignments. All user accounts and access privileges — including third-party and vendor accounts — must be reviewed at least every six months (Requirement 7.2.4). Application and system accounts should also follow least-privilege principles (Requirement 7.2.5).
Go on to Requirement 8 - Access Control.
Go back to Requirement 6 - System Security.