PCI DSS Requirement 7: Access Control by Business Need to Know

Requirement Structure

Deep Dives

• 7.2.1 - Define an access control model: appropriate access by business need; based on job classification and function; least privileges required to perform the job.
• 7.2.2 / 7.2.3 - Assign user access (including privileged users) by job classification/function and least privilege; required privileges approved by authorized personnel.
• 7.2.4 - Review all user accounts and related privileges - including third-party/vendor accounts and accounts used to access third-party cloud services - at least once every six months; ensure appropriateness; address inappropriate access; management acknowledges. Mandatory since 31 March 2025.
• 7.2.5 / 7.2.5.1 - Application and system accounts: least privilege for operability; limited to systems, applications, or processes that specifically require them; periodic review frequency via a 12.3.1 TRA; address inappropriate access; management acknowledges. Mandatory since 31 March 2025.
• 7.2.6 - User access to query repositories of stored cardholder data only via applications or other programmatic methods with role-based least privilege; only the responsible administrator(s) may directly access or query those repositories.
• 7.3.1-7.3.3 - Access control system(s) restrict access based on need to know across all system components; enforce permissions by job classification and function; default deny all.

How CyberSilo Helps

• Compliance Standards Automation - access-review and privilege-evidence workflows
• ThreatHawk SIEM - privileged and anomalous access alerts that support Requirements 7, 8, and 10

Frequently Asked Questions

How often must user access be reviewed under 7.2.4?

At least once every six months (mandatory since 31 March 2025), including third-party/vendor accounts and accounts used to access third-party cloud services.

Do application and system accounts fall under 7.2.4?

Application and system account privileges are assigned and reviewed under 7.2.5 and 7.2.5.1 (with review frequency defined in a 12.3.1 targeted risk analysis). A 7.2.4 user-account review alone is not enough.

Can analysts directly query the CHD database?

Under 7.2.6, users query stored CHD repositories via applications or programmatic methods with role-based least privilege. Only responsible administrator(s) may directly access or query those repositories.

Related PCI Resources

PCI DSS hub · 12 requirements explained · Requirement 8 · Requirement 12