PCI DSS · Requirement 7: Restrict access to system components and cardholder data by business need to know

Access assigned by job function and least privilege

frameworkPCI DSS v4.0.1 sectionRequirement 7: Restrict access to system components and cardholder data by business need to know csf 2.0GV.RR-04 PR.AA-05 PR.DS-10 topicsAccess Control, Privileged Access frameworks7 5 0

Official text · not licensableSummary (ControlMapping's wording): Access assigned by job function and least privilege. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 7.2.2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-01 PR.AA-05	Identities and credentials for authorized users, services, and hardware are managed by the organization; Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	Crosswalk	Same topic: Access Control, Privileged Access 2 loosely related (not mappings) GV.RR-04 Cybersecurity is included in human resources practices Loosely related Only shares CSF GV.RR-04: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping
ISO 27001	A.5.15 A.5.16 A.5.18 A.8.2 A.8.3 A.8.18	Access control; Identity management…	Crosswalk	Same topic: Access Control, Privileged Access 23 loosely related (not mappings) A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.6.1 Screening Loosely related Only shares CSF GV.RR-04, PR.DS-10: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF GV.RR-04, PR.DS-10: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF GV.RR-04, PR.DS-10: related, not a mapping A.6.7 Remote working Loosely related Only shares CSF GV.RR-04, PR.AA-05: related, not a mapping A.8.4 Access to source code Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 15 more in the downloads
CIS v8.1	CIS 3.3 CIS 5.1 CIS 5.6 CIS 6.7 CIS 6.8 CIS 5.2 CIS 5.3 CIS 5.4 CIS 5.5 CIS 6.1 CIS 6.2 CIS 6.6 CIS 12.5 CIS 12.8	Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts…	Crosswalk	Same topic: Access Control, Privileged Access 10 loosely related (not mappings) CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.4 Enforce Data Retention Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 4.10 Enforce Automatic Device Lockout on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.11 Enforce Remote Wipe Capability on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.12 Separate Enterprise Workspaces on Mobile End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 2 more in the downloads
SOC 2	CC6.1 CC6.2 CC6.3	Logical access security over information assets; User registration, authorization and removal…	Editorial	Same topic: Access Control, Privileged Access (editorial pick) 4 loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-10: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.AA-05: related, not a mapping
CMMC	AC.L2-3.1.1 AC.L2-3.1.2 AC.L2-3.1.5 AC.L2-3.1.6 AC.L2-3.1.7	Authorized Access Control; Transaction & Function Control…	Crosswalk	Same topic: Access Control, Privileged Access 34 loosely related (not mappings) SC.L2-3.13.3 Role Separation Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF PR.DS-10: related, not a mapping AC.L2-3.1.4 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.12 Control Remote Access Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.13 Remote Access Confidentiality Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.14 Remote Access Routing Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.15 Privileged Remote Access Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.16 Wireless Access Authorization Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 26 more in the downloads
800-53	AC-2 AC-2(7)AC-3 AC-6(5)	Account Management; Privileged User Accounts…	Crosswalk	Same topic: Access Control, Privileged Access 36 loosely related (not mappings) AC-4 Information Flow Enforcement Loosely related Only shares CSF PR.DS-10: related, not a mapping AC-5 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-6 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-10 Concurrent Session Control Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-16 Security and Privacy Attributes Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-17 Remote Access Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-18 Wireless Access Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-19 Access Control for Mobile Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 28 more in the downloads
HIPAA	§164.308(a)(4)§164.312(a)§164.312(a)(2)(i)§164.312(d)	Information Access Management; Access Control…	Crosswalk	Same topic: Access Control 29 loosely related (not mappings) §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF GV.RR-04, PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF GV.RR-04, PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF GV.RR-04, PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.RR-04, PR.DS-10: related, not a mapping §164.310(b) Workstation Use Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping …and 21 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Editorial	Same topic: Access Control (editorial pick) 4 loosely related (not mappings) Art.5(1)(e) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.29 Processing under the authority of the controller or processor Loosely related Only shares CSF GV.RR-04: related, not a mapping Art.32(4) Security of processing Loosely related Only shares CSF GV.RR-04: related, not a mapping
NIS2	11.1 11.2 11.3 11.4 11.5	Access control policy; Management of access rights…	Crosswalk	Same topic: Access Control, Privileged Access 4 loosely related (not mappings) 10.1 Human resources security Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.2 Verification of Background Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.3 Termination or change of employment procedures Loosely related Only shares CSF GV.RR-04: related, not a mapping 11.6 Authentication Loosely related Only shares CSF PR.AA-05: related, not a mapping
Essential Eight	ISM-0445 ISM-1175 ISM-1380 ISM-1387 ISM-1507 ISM-1508 ISM-1647 ISM-1648	Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online……	Editorial	Same topic: Privileged Access (editorial pick) 12 loosely related (not mappings) ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1649 Just-in-time administration is used for the administration of systems and their resources Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1650 Privileged user account and security group management events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1685 Credentials for break glass accounts, local administrator accounts and service accounts… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1686 Credential Guard functionality is enabled Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1687 Privileged operating environments are not virtualised within unprivileged operating… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1688 Unprivileged user accounts cannot be used to log on to privileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1689 Privileged user accounts (excluding local administrator accounts) cannot be used to log… Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 4 more in the downloads
DORA	Art.9(4)(c)	Protection and prevention	Editorial	Same topic: Access Control, Privileged Access (editorial pick) 4 loosely related (not mappings) Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF GV.RR-04: related, not a mapping
CPS 234	Para 21	Timely controls commensurate with risk and asset life-cycle	Loosely related	No mapping. Only shares CSF PR.DS-10: related, not a mapping
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Access Control, Privileged Access (editorial pick) 1 loosely related (not mappings) CE 2 Secure Configuration Loosely related Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.