[Autogenerated] requirements.
7.2 is the implementation of the role based access
defining the previous requirement,
and it wants to have an access control system to implement.
This on by an access control system is looking for something
like Active Directory or L'd app or radius,
where users groups and access rights to defined.
There are three sub requirements that detail how the
access control system must be configured.
They all have the same testing requirements, which will look at the end.
You'll also notice that there's no additional guidance
provided for each of the sub requirements.
The first sub requirement, then,
is to make sure that all system components error included.
And here I want to highlight part the guidance that says you
can have one or more access control systems.
So it's not the case that every single device in your cardholder data
environment has to talk to one access control system.
You can have as many as you need requirements.
7.2 point two just wants to make sure that the role based
access defining requirements 7.1 is actually implemented
on the final sub requirement.
7.2 point three wants to make sure that the default for the
access control system or access control systems is that
unless access is explicitly granted,
a user or role has no access by default and to check these
three sub requirements are in place.
The HUSA is at last actually going to look at the
configuration of the access control system and specifically
that the default is to deny all access.