7.1 Is access to system components and cardholder data limited to only those individuals whose jobs require such access, as follows: 7.1.2 Is access to privileged user IDs restricted as follows: Examine written access control policy To privileges necessary to perform job Interview personnel responsibilities? Interview management Assigned only to that specifically require that Review privileged user IDs privileged access? 7.1.3 Are access assigned on individual personnel’s job Examine written access control policy classification and function? Interview management Review user IDs Requirement 8: Identify and authenticate access to system components Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A Are all assigned a unique ID before allowing them 8.1.1 Review password procedures to access system components or cardholder data? Interview personnel Is access for any terminated immediately 8.1.3 Review password procedures deactivated or removed? Examine terminated users accounts Review current access Observe returned physical authentication devices Are accounts used by vendors to access, support, 8.1.5 Review password procedures or maintain system components via remote access Interview personnel enabled only during the time period needed and Observe processes disabled when not in use?
7.1 Is access to system components and cardholder data limited to only those individuals whose jobs require such access, as follows: 7.1.2 Is access to privileged user IDs restricted as follows: To privileges necessary to perform job responsibilities? Assigned only to that specifically require that privileged access? Examine written access control policy Interview personnel Interview management Review privileged user IDs 7.1.3 Are access assigned on individual personnel’s job classification and function? Examine written access control policy Interview management Review user IDs Requirement 8: Identify and authenticate access to system components PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 8.1.1 Are all assigned a unique ID before allowing them to access system components or cardholder data? Review password procedures Interview personnel 8.1.3 Is access for any terminated immediately deactivated or removed? Review password procedures Examine terminated users accounts Review current access Observe returned physical authentication devices 8.1.5 Are accounts used by vendors to access, support, or maintain system components via remote access enabled only during the time period needed and disabled when not in use? Review password procedures Interview personnel Observe processes