Free guide · PCI DSS v4.0.1

PCI DSS Requirement 7.2.2 — Least privilege and business need to know

Requirement 7.2.2 requires that access — including privileged access — is assigned on the basis of job classification and function, and limited to the least privileges necessary to perform those responsibilities. Requirement 7.2.1 sits above it and requires a defined access control model.Timing: Applies in PCI DSS v4.0.1 and is assessed at every annual assessment.

Find your SAQ All guides

Who it applies to

All user and privileged accounts with access to in-scope system components or account data

Entities completing SAQ C, SAQ D-Merchant or SAQ D for Service Providers

What Requirement 7.2.2 asks for

Paraphrased from PCI DSS v4.0.1. Read the standard itself for the authoritative wording and testing procedures.

A documented access control model defines how access is granted (Requirement 7.2.1).

Access is assigned based on job classification and function.

Access is limited to the least privileges necessary to perform job responsibilities.

Assignment of privileges is approved by authorised personnel.

Evidence an assessor expects

The documented access control model and role definitions

A user-to-role mapping for every in-scope system

Approval records for privileged access grants

Review records showing access was re-verified at the required interval

Common mistakes

Everyone in a team sharing one broad administrator role because it is easier to manage.

Contractor and leaver accounts retaining privileges after the engagement ends.

Service and application accounts excluded from the model because 'no human uses them'.

Not sure whether Requirement 7.2.2 is in your scope?

Which requirements you must answer depends on the SAQ that applies to your environment. The free SAQ selector walks the official PCI SSC decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Paraphrased from PCI DSS v4.0.1 (PCI Security Standards Council). Independent summary; not endorsed by PCI SSC. Refer to the PCI SSC Document Library for the authoritative standard.