Rule-based Access Control
PCIComplianceHubLast updated
An access control model that manages user access to resources and functions based on specific rules or conditions. Rule-based access control can be used in combination with role-based access control (RBAC) to ensure that users have the minimum necessary access to cardholder data and related systems, as required by PCI DSS.
Applies to. PCI DSS v4.0.1 does not name rule-based access control. Requirement 7 leaves the choice of access control model to the entity, as long as access is granted by job function, limited to what the role needs and reviewed at least once every six months; rules such as time of day, source network or device type can sit on top of that model and narrow it further. That layering is general practice rather than something the standard asks for.
Related. RBAC (Role-Based Access Control), Access Control, Least Privilege, Logical Access Control, Access Control List (ACL)
Sources. PCI DSS v4.0.1 (June 2024)