7.1.1 Requirement 7 policies and procedures maintained
Every security policy and operational procedure that Requirement 7 calls for must be written down, kept current, actually followed in practice, and made known to everyone they affect. In this requirement set that means the documents governing need-to-know restriction, how access is defined and assigned, and how access control systems are operated. The guidance adds that documents are best revised soon after changes in processes, technology or business objectives rather than only on a fixed review cycle. Customized approach objective: management's expectations, controls and oversight for Requirement 7 activities are set out and followed by the relevant staff, so that supporting activities are repeatable, consistent and aligned with management intent.
Source: PCI DSS v4.0.1, 7.1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.
Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Change log showing the documents were revised after process or technology changes · SIEM / log platform
periodic reviewEvidence produced at each review
- Evidence of dissemination, such as intranet publication records or staff acknowledgements · HR system / LMS
governing documentDocuments that govern the control
- Approved access control policy covering need-to-know and least privilege, with version history and last review date · Policy repository / GRC workspace
- Operational procedures for access requests, approvals, provisioning and reviews · Policy repository / GRC workspace
First move
Common gaps auditors find
- Access control policy exists but has not been revised since the move to a new identity platform
- Procedures are held only by the IAM team and are unknown to line managers who approve access
- Documents describe a role model that no longer matches how access is actually granted
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet6.5.6 Remove test data and accounts before production · 7.1.2 Requirement 7 roles and responsibilities assigned