Requirement 7: Restrict access to cardholder data by business need to know Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A 7.1 Is access to system components and cardholder data limited to only those individuals whose jobs require such access, as follows: 7.1.2 Is access to privileged user IDs restricted as follows: Examine written access control policy To privileges necessary to perform job responsibilities? Interview personnel Assigned only to that specifically require that Interview management privileged access? Review privileged user IDs 7.1.3 Are access assigned on individual personnel’s job Examine written access control classification and function? policy Interview management Review user IDs
Requirement 7: Restrict access to cardholder data by business need to know PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 7.1 Is access to system components and cardholder data limited to only those individuals whose jobs require such access, as follows: 7.1.2 Is access to privileged user IDs restricted as follows: To privileges necessary to perform job responsibilities? Assigned only to that specifically require that privileged access? Examine written access control policy Interview personnel Interview management Review privileged user IDs 7.1.3 Are access assigned on individual personnel’s job classification and function? Examine written access control policy Interview management Review user IDs