Access control is the gatekeeper of the CDE. Even if an attacker bypasses the network perimeter, strong access controls can contain the damage — limiting which systems can be reached and which data can be read, modified, or exfiltrated. Requirement 7 establishes the principle of least privilege as the governing model for all access to CDE systems and cardholder data.
The Principle of Least Privilege
Access to system components and cardholder data must be limited to only those individuals whose job requires that access. This is the "need-to-know" principle: if a person's job function does not require access to cardholder data, they should not have it — regardless of their seniority or role.
| KEY IDEA | Least privilege is not just about blocking external threats — it is about limiting the blast radius of any breach. An attacker who compromises a low-privilege account gains only what that account can access. An organization where every employee has broad CDE access amplifies every credential compromise into a potential full CDE breach. |
Access Control Model — What PCI DSS Requires
PCI DSS v4.0 requires a formally documented access control model. Access must be assigned based on: the individual's job classification and function, the minimum access rights required to perform that function, and formal authorization from management.
| Access Control Component | PCI DSS Requirement | Implementation Approach |
|---|---|---|
| Least privilege assignment | Access based on minimum necessary for job function | Role-based access control (RBAC) with documented role definitions |
| Access authorization | All access formally authorized before provisioning | Ticket-based provisioning with manager approval workflow |
| Access documentation | All user IDs and their access rights documented | User access register maintained and current |
| Access review | Periodic review of all user access rights | Quarterly access reviews for CDE systems — recertification by managers |
| Access revocation | Access removed when no longer required | HR-IT offboarding workflow, immediate revocation on termination |
Privileged Access — The Highest Risk
Privileged access (admin, root, DBA) to CDE systems is the most dangerous access category. PCI DSS requires: privileged access is assigned only when required for a specific task, privileged accounts are not used for routine activities, all privileged access is logged and monitored, and administrative access is reviewed more frequently.
| IMPORTANT | The most common access control failure in PCI DSS assessments is not missing access controls — it is access accumulation over time. Users who change roles retain their old access rights. Departed employees whose accounts were not properly deprovisioned. Developers who were given temporary production access during an incident and never had it removed. Regular access reviews (at least quarterly for CDE systems) are the mandatory antidote. |
Third-Party and Vendor Access
Third-party vendor access to the CDE is subject to all Requirement 7 controls — and adds additional requirements for monitoring and authorization. All third-party access must be: limited to the systems they need to support, enabled only when needed and disabled when not in use, monitored during the session, and covered by a contractual agreement including PCI DSS security obligations.
Documentation Requirements for QSA Assessment
QSAs testing Requirement 7 will request: the access control model documentation, the list of all user accounts with access to CDE systems, evidence of the access review process (including records of reviews conducted), and evidence that access was removed promptly when personnel changed roles or departed.
| For Indonesian organizations undergoing their first PCI DSS assessment, Requirement 7 compliance often requires more process redesign than technical implementation. The technical capability to restrict access is usually present — the gap is in the formalized authorization workflow, the documented role definitions, and the access review cadence. Prioritize building the access governance process, not just the technical controls. |