Logical Access Control

Applies to. It covers the mechanisms on system components, such as operating system permissions, application roles and database grants, that decide which authenticated user or application can reach which information. 7.2.1 is where PCI DSS has the entity define that model, granting access to system components and data resources by business need, job classification and function, and least privilege. 10.7.2 lists logical access controls among the critical security control systems whose failure must be detected, alerted and addressed promptly, and 3.5.1.3 requires the logical access that unlocks disk-level encrypted PAN to be managed separately from the operating system's native authentication and access control.

Example. An e-commerce merchant keeps its order database on a server in the Cardholder Data Environment. Logical access control is the set of decisions enforced on that server: the web application's account can insert and read orders, the reporting account can only read, and no one else has a login. If the directory service that enforces those permissions fails, 10.7.2 expects the merchant to detect it and act promptly.

Limits. Logical access control is the software half of a pair. Locks, badge readers and visitor escorts are physical access control, a separate Council term with its own requirements. It also stops short of authentication: proving who the user is comes first, and logical access control then decides what that proven identity may reach. Encryption is not logical access control either; 3.5.1.3 makes the point by requiring the two to be kept independent when disk-level encryption protects PAN, so that an operating system login does not by itself unlock the data.