Scribd
Upload
13 views2 pages

Sample Access Control Policy

The Access Control Policy establishes requirements for restricting access to cardholder data based on the principle of least privilege to ensure compliance with PCI-DSS. It applies to all personnel with access to the organization's information systems and outlines specific policy statements regarding access rights, password policies, and multi-factor authentication. Procedures for implementation and roles and responsibilities are also defined to maintain security and monitor access effectively.

Uploaded by

PRASAD PATHAK
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
13 views2 pages

Sample Access Control Policy

The Access Control Policy establishes requirements for restricting access to cardholder data based on the principle of least privilege to ensure compliance with PCI-DSS. It applies to all personnel with access to the organization's information systems and outlines specific policy statements regarding access rights, password policies, and multi-factor authentication. Procedures for implementation and roles and responsibilities are also defined to maintain security and monitor access effectively.

Uploaded by

PRASAD PATHAK
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Access Control Policy

1. Purpose
The purpose of this Access Control Policy is to establish requirements for restricting access to
cardholder data and information systems based on the principle of least privilege. This ensures
compliance with PCI-DSS requirements 7 and 8.

2. Scope
This policy applies to all employees, contractors, consultants, and third-party vendors who have
access to the organization’s information systems and cardholder data.

3. Policy Statements
• Access rights shall be role-based and reviewed quarterly.
• Unique IDs must be assigned to each user before system access is granted (PCI-DSS Req. 8.1).
• Strong password policy must be enforced: at least 12 characters, mix of uppercase, lowercase,
numbers, and symbols, changed every 90 days.
• Inactive accounts shall be disabled within 90 days.
• User accounts must be disabled within 24 hours of termination or role change.
• Multi-factor authentication (MFA) must be enforced for all remote access (PCI-DSS Req. 8.3).
• Privileged access must be logged and monitored continuously (PCI-DSS Req. 10).

4. Procedures / Implementation Guidelines


• IT Security team to maintain an access control matrix mapping roles to system privileges.
• Quarterly user access reviews will be conducted by managers and validated by the IT Security
team.
• Accounts for terminated employees will be disabled within 24 hours by HR notifying IT Security.
• Password policy will be enforced via centralized authentication systems (e.g., Active Directory).
• MFA will be implemented using approved corporate authentication solutions (e.g., Duo, RSA).

5. Roles & Responsibilities


6. References
• PCI-DSS v4.0 Requirements 7, 8, and 10
• ISO/IEC 27001:2022 Annex A.9 - Access Control

You might also like