[Autogenerated] requirements.
Seven is all about who has access to systems that store
process transmit cardholder data.
In simple terms.
It's the authorization requirement, and strangely,
it comes before authentication, which is the subject of Requirement eight.
It's quite a short requirement on Firstly demands
access control based on people's roles,
including the management of privileged access and secondly,
that all access is based on the concept of least privilege.
The last of requirement is the usual one to have the
relevant policies and procedures,
as this requirement is concerned with rights and privileges that people have.
When the access system,
components and data within the cardholder data environment,
it applies to all systems,
and that includes networking equipment as well as
traditional servers applications.
Workstations on database is the overall aim of requirements.
7.1 is very simple,
but access is restricted to people who need it and in a couple of
minutes will meet the prescriptive sub requirements.
But the basic demand is that there has to be legitimate
business need for anyone to have access to systems in the
cardholder data environment.
The testing requirement here is for the QoS A to review the access control
policies and make sure they incorporate not only the need to know but also the
rules contained in each of the sub requirements.
On the first of these sub requirements is 7.1 point one,
which requires an organization to define the separate roles
that need access to the cardholder data environments
alongside each roller is defined.
You also need to define the minimum rights and privileges that
the role needs to be able to do its job,
and these roles and rights will need to be documented because of this state.
The standard hasn't said how the rights will be given to people.
And so the QoS is testing procedures to look at the documentation,
not at the systems such as Directory Serb yet,
and look at the documentation where the rights configured and
enforced The next of requirement is concerned with the rights
given to privileged accounts.
And in case you're wondering,
PC IDE CSS defines a privileged account or a privileged user is
one that has more than normal access privileges.
That doesn't just mean a system administrator,
but any user or account with any type of raised access.
The requirement, then,
is for such privileged accounts to only have the minimum level of extra
privileges or access rights they need for the role.
In simple terms,
this means that you don't give enterprise or domain admin rights to
just any account that needs to do something special,
work out what the additional rights required are on,
then just give those additional rights.
I could call this the don't be lazy when granting rights requirements.
It's also important to remember that as the previous sub
requirement defined the need for role based access,
any level of privileged access also needs to be granted to a role or a group,
not to individual user accounts.
You would think that the testing procedure for this requirement will be for
the QoS A to look at the system used for granting rights.
But like all the 7.1,
this requirement is about the principles and organization has to assign rights.
And so first, the QoS a will actually interviewed two groups of people initially,
the people who assigned privileges to people and secondly,
people described as management personnel to verify both of the rights of the
men in required on that they're necessary for somebody's job.
The next sub requirement closes the role based access model by
requiring that people are added into the roles.
And so what's needed here is when people need right to do the job.
The people are added to a role on the rights error
not given to them as individuals.
Again,
the QoS a will interview management to make sure that individuals
error allocated to groups based on their jobs.
The final search requirement,
this section 7.1 point four specifies that when people are granted rights,
there's a specific approval needed on that.
This approval needs to be by authorized management
that details the privileges required.
That's API.
See IDE CSS.
Where is saying that it expects a manager to say that a
person should be able to a group or a role that gives them
the rights they need to do their job?
To test this,
these QoS a is going to look for documentary evidence that
management approved a person being granted rights.
And as the testing procedure says, this documented approval could be Elektronik.
So something like part of a join us or movers workflow