PCI DSS 4.0
Req 7: Restrict Access by Need to Know

PCI DSS 4.0 7.2.2: 7.2.2 User access assigned by job function and least privilege

Access for every user, including privileged users, must be assigned on the basis of the user's job classification and function, and restricted to the least privileges needed to perform that person's responsibilities. The guidance explains that once role needs are defined under 7.2.1, individuals can be granted access by placing them in the matching roles, gives the example that a database or backup administrator should not hold the full privileges of a systems administrator, and suggests entities may consider privileged access management that grants elevated rights only when needed and removes them afterwards. Objective under the customized approach: access to systems and data is confined to what each job function needs, as set out in the related access roles.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 58 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 5 controls

FedRAMP Moderate · 5 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 4 controls

  • ANSSI-HYG-06 Organise Joiner, Leaver and Role Change Procedures
  • ANSSI-HYG-08 Identify Each Person by Name and Separate User and Administrator Roles
  • ANSSI-HYG-09 Assign the Correct Rights on Sensitive Resources
  • ANSSI-HYG-29 Limit Administration Rights on Workstations to Operational Need

CIS Controls v8 · 4 controls

  • CIS-5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts
  • CIS-6.1 Establish an Access Granting Process
  • CIS-6.7 Centralize Access Control
  • CIS-6.8 Define and Maintain Role-Based Access Control

NIST SP 800-53 Rev 5 · 4 controls

AWS Well-Architected Security Pillar · 3 controls

C5 (Germany) · 3 controls

  • C5-IDM-02 Granting and change of user accounts and access rights
  • C5-IDM-04 Withdraw or adjust access rights as the task area changes
  • C5-IDM-06 Privileged access rights

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

ISO 27001:2022 · 3 controls

  • 5.15 Access control
  • 5.18 Access rights
  • 8.2 Privileged access rights

ISO 27002:2022 · 3 controls

  • 5.15 Access control
  • 5.18 Access rights
  • 8.2 Privileged access rights

Azure Security Benchmark · 2 controls

  • ASBv3-PA-7 Follow just enough administration (least privilege) principle
  • PA-1 Separate and limit highly privileged/administrative users

CMMC 2.0 · 2 controls

HIPAA Security Rule · 2 controls

NIST SP 800-66 Rev 2 · 2 controls

ACSC Essential Eight · 1 control

  • E8-ADMIN-ML3 Restrict Administrative Privileges (ML3)

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-18 Restrict administrative privileges (Essential)

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

ISO 27701:2019 · 1 control

  • 6.6.2 User access management

NIS2 Directive · 1 control

  • Art.21.2.g Basic cyber hygiene practices and cybersecurity training

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-172 · 1 control

  • 3.13.2e Introduce Unpredictability into System Operations

PCI 3DS Core Security Standard · 1 control

  • P1-5.1.3 P1-5.1.3 Least privilege by job function, reviewed periodically

SOC 2 · 1 control

  • SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties

UK Cyber Essentials · 1 control

  • CE-AC.4 Privileged Account Approval and Tracking

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Req 7: Restrict Access by Need to Know

You are reading one control. How much of PCI DSS 4.0 have you already done?

PCI DSS 4.0 7.2.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.

If you hold ISO 27001:202249.6% covered · 141 gapsIf you hold FedRAMP Moderate49.3% covered · 142 gapsIf you hold NIST SP 800-53 Rev 547.5% covered · 147 gapsIf you hold ISO 27002:202243.2% covered · 159 gapsIf you hold CIS Controls v838.2% covered · 173 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.136.4% covered · 178 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 58 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll PCI DSS 4.0 controls