Implement Strong Access Control Measures Requirement 7: Restrict access to cardholder data by business need to know Response one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A 7.1 Is access to system components and cardholder data limited to only individuals whose jobs require such access, as follows: 7.1.2 Is access to privileged user IDs restricted as follows: Examine written access control policy To least privileges necessary to perform job Interview personnel responsibilities? Interview management Assigned only to roles that specifically require that Review privileged user IDs privileged access? 7.1.3 Are access assigned based on individual personnel’s Examine written access control policy job classification and function? Interview management Review user IDs Requirement 8: Identify and authenticate access to system components Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A Are accounts used by vendors to access, support, 8.1.5 Review password procedures or maintain system components via remote access Interview personnel enabled only during the time period needed and Observe processes disabled when not in use? Are vendor remote access accounts monitored Interview personnel when in use? Observe processes
Implement Strong Access Control Measures Requirement 7: Restrict access to cardholder data by business need to know PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 7.1 Is access to system components and cardholder data limited to only individuals whose jobs require such access, as follows: 7.1.2 Is access to privileged user IDs restricted as follows: To least privileges necessary to perform job responsibilities? Assigned only to roles that specifically require that privileged access? Examine written access control policy Interview personnel Interview management Review privileged user IDs 7.1.3 Are access assigned based on individual personnel’s job classification and function? Examine written access control policy Interview management Review user IDs Requirement 8: Identify and authenticate access to system components PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 8.1.5 Are accounts used by vendors to access, support, or maintain system components via remote access enabled only during the time period needed and disabled when not in use? Review password procedures Interview personnel Observe processes Are vendor remote access accounts monitored when in use? Interview personnel Observe processes