PCI DSS · Implement strong access control

Req. 7 Restrict access by business need to know

Limit access to system components and cardholder data to only those individuals whose job requires it.

Mapped across 14 provisions

Equivalent and related requirements in other frameworks and regulations.

NIST CSF 2.0EquivalentOfficial mapping
Source: PCI DSS v4.0 / NIST CSF 2.0
PR.AA-01 Identities and credentials managed
Access control & identity
CIS Controls v8EquivalentCurated
6.1 Establish an access granting process
Access control & identity
Cyber EssentialsEquivalentCurated
CE-3 User access control
Access control & identity
DORAPartialCurated
Art. 9 Protection and prevention
Access control & identity
Essential EightPartialCurated
E8-3 Multi-factor authentication
Access control & identity
Essential EightPartialCurated
E8-4 Restrict administrative privileges
Access control & identity
GLBAEquivalentCurated
§314.4(c)(1) Access controls
Access control & identity
HIPAAEquivalentCurated
§164.312(a)(1) Access control
Access control & identity
ISO 27001EquivalentCurated
A.5.15 Access control
Access control & identity
NIS2PartialCurated
Art. 21(2)(i) Access control and asset management
Access control & identity
NIST 800-171EquivalentCurated
3.1.1 Limit system access to authorized users
Access control & identity
NIST 800-53EquivalentCurated
AC-2 Account management
Access control & identity
PCI DSSEquivalentCurated
Req. 8 Identify users and authenticate access
Access control & identity
SOC 2EquivalentCurated
CC6.1 Logical access security controls
Access control & identity