A1.1.2 Controls are implemented such that each customer only has permission to access its own cardholder data and CDE.

Defined Approach Requirements

A1.1.2 Controls are implemented such that each customer only has permission to access its own cardholder data and CDE.

Customized Approach Objective

Customers cannot access other customers' environments.

Defined Approach Testing Procedures

A1.1.2.a Examine documentation to verify controls are defined such that each customer only has permission to access its own cardholder data and CDE.

A1.1.2.b Examine system configurations to verify that customers have privileges established to only access their own account data and CDE.

Purpose

It is important that a multi-tenant service provider define controls so that each customer can only access their own environment and CDE to prevent unauthorized access from one customer's environment to another.

Examples

In a cloud-based infrastructure, such as an infrastructure as a service (IaaS) offering, the customers' CDE may include virtual network devices and virtual servers that are configured and managed by the customers, including operating systems, files, memory, etc.