RBAC (Role-Based Access Control)
PCIComplianceHubLast updated
A way of granting access by assigning users to roles and giving each role the permissions its job needs, rather than granting rights to people one by one. PCI DSS v4.0.1 names RBAC only in the guidance to 7.2.1, as one example of the access control model Requirement 7 asks each entity to define; it does not require it.
Applies to. 7.2.1 asks each entity to define an access control model that grants access by business need, by job classification and function, and with the least privileges a job needs; the guidance to that control gives RBAC as an example of such a model, and roles are the usual way to build it. Access assigned by role still has to be reviewed, together with the user accounts that hold it, at least once every six months under Requirement 7.
In PCI DSS v4.0.1. 7.2.1
Related. Least Privilege, Logical Access Control, Access Control, Rule-based Access Control, Granular Access Control
Sources. PCI DSS v4.0.1 (June 2024)