Least Privilege

Applies to. Requirement 7 applies the principle at three levels: the access control model itself, which 7.2.1 requires to grant the least privileges needed for a job function; each user's assigned access, including privileged users, which 7.2.2 ties to job classification, function and least privileges; and application and system accounts, which 7.2.5 limits to the least privileges needed for the system or application to operate and to the systems and processes that need them. 7.2.6 then applies it to stored cardholder data: user access to query repositories of stored CHD must go through an application or other programmatic method, with allowed actions set by role and least privilege, and only the responsible administrators may query the repository directly.

Example. A payments operations analyst needs to look up individual transactions to resolve disputes. Under least privilege she gets a reporting application that returns the records her role needs, while the database account that can run arbitrary queries against the stored cardholder data stays with the two database administrators.

Limits. Least privilege governs how much access an account holds, not whether the person using it is who they claim, which is authentication under Requirement 8. It is not separation of duties either: that splits one sensitive task between people, whereas least privilege is satisfied by one person holding exactly the rights the job needs and nothing more. 7.2.2 ties privileges to job classification and function, so rights carried over from a previous role do not fit the principle even if each was once justified. And 7.2.6 shows the principle reaches data as well as systems: a role that can view stored cardholder data through an application does not thereby earn a direct query path to the repository, which only the responsible administrators may have.