7.1.2 Roles and responsibilities for performing activities in Requirement 7 are documented, assigned, and understood.
Defined Approach Requirements
7.1.2 Roles and responsibilities for performing activities in Requirement 7 are documented, assigned, and understood.
Defined Approach Testing Procedures
7.1.2.a Examine documentation to verify that descriptions of roles and responsibilities for performing activities in Requirement 7 are documented and assigned.
7.1.2.b Interview personnel with responsibility for performing activities in Requirement 7 to verify that roles and responsibilities are assigned as and are understood.
Customized Approach Objective
Day-to-day responsibilities for performing all the activities in Requirement 7 are allocated. Personnel are accountable for successful, continuous operation of these requirements.
Purpose
If roles and responsibilities are not formally assigned, personnel may not be aware of their day-to-day responsibilities, and critical activities may not occur.
Good Practice
Roles and responsibilities may be documented within policies and procedures or maintained within separate documents.
As part of communicating roles and responsibilities, entities can consider having personnel acknowledge their acceptance and understanding of their assigned roles and responsibilities.
Examples
A method to document roles and responsibilities is a responsibility assignment matrix that includes who is responsible, accountable, consulted, and informed (also called a RACI matrix).
purpose
Assign and document roles and responsibilities for access control.
compliance strategies
- RACI matrix
- Role-based training
typical policies
- Access Control Responsibility Matrix
common pitfalls
- Unclear accountability
- Overlapping assignments
type
Governance
difficulty
Low
key risks
- Gaps in access management
recommendations
- Integrate with HR onboarding/offboarding
Eligible SAQ
- SAQ-D MERCHANT
- SAQ-D SERVICE PROVIDER
Your perspective on this PCI DSS requirement matters! Share your implementation experiences, challenges, or questions below. Your insights help other organizations improve their compliance journey and build a stronger security community.Comment Policy