Application and System Accounts
Also: Service accounts
PCIComplianceHubLast updated
Accounts that exist for a process or a service rather than for a person: the identity a batch job, a database connection or a monitoring agent runs under. They typically hold elevated privileges for one narrow task and are not meant to be logged into by an individual.
Applies to. Every in-scope system that runs services, scheduled jobs or integrations under their own identity, which is nearly all of them.
Example. The identity a payment application uses to connect to its database. 7.2.5 requires its privileges to be the least needed for that job; 8.6.1 requires that nobody can log in with it interactively unless there is a documented need, an approval, and attribution to the person doing so.
Limits. These accounts are the usual route to an unattributable action, because several people may know their password. That is why 8.6.2 forbids hard-coding their passwords into scripts and files, 8.6.3 sets rules for changing them, and 10.2.1.2 requires interactive use of them to be logged. Reviewing their access at least every six months (7.2.5.1) is a v4.x addition.