Requirement 7: Restrict access to cardholder data by business need to know Response one response for each question) PCI DSS Question Expected Testing Yes with Not Yes CCW No N/A Tested 7.1 Is access to system components and cardholder data limited to only those individuals whose jobs require such access, as follows: Is a written policy for access control that Examine written access control incorporates the following? policy Defining access needs and privilege assignments for each role Restriction of access to privileged user IDs to least privileges necessary to perform job responsibilities, Assignment of access based on individual personnel’s job classification and function Documented approval (electronically or in writing) by authorized parties for all access, including listing of specific privileges approved 7.1.1 Are access needs for each role defined, including: Examine roles and access needs System components and data resources that each role needs to access for their job function? Level of privilege required (for example, user, administrator, etc.) for accessing resources? 7.1.2 Is access to privileged user IDs restricted as follows: Interview personnel To least privileges necessary to perform job Interview management responsibilities? Review privileged user IDs Assigned only to roles that specifically require that privileged access? 7.1.3 Are access assigned based on individual personnel’s job Interview management classification and function? Review user IDs
Requirement 7: Restrict access to cardholder data by business need to know PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A Not Tested 7.1 Is access to system components and cardholder data limited to only those individuals whose jobs require such access, as follows: Is a written policy for access control that incorporates the following? Defining access needs and privilege assignments for each role Restriction of access to privileged user IDs to least privileges necessary to perform job responsibilities, Assignment of access based on individual personnel’s job classification and function Documented approval (electronically or in writing) by authorized parties for all access, including listing of specific privileges approved Examine written access control policy 7.1.1 Are access needs for each role defined, including: System components and data resources that each role needs to access for their job function? Level of privilege required (for example, user, administrator, etc.) for accessing resources? Examine roles and access needs 7.1.2 Is access to privileged user IDs restricted as follows: To least privileges necessary to perform job responsibilities? Assigned only to roles that specifically require that privileged access? Interview personnel Interview management Review privileged user IDs 7.1.3 Are access assigned based on individual personnel’s job classification and function? Interview management Review user IDs
SAQ_D_v3_Merchant.docx