User-Managed Access (UMA)

PCIComplianceHubLast updated

A protocol, built on OAuth 2.0, that lets a person decide which third-party applications and services may reach their own data held by a service. PCI DSS v4.0.1 does not name it; where it is used to delegate access to records that include account data, the systems holding those records stay in scope and Requirement 7 still limits each party's access to business need.

Applies to. PCI DSS v4.0.1 does not name UMA. It comes up where an entity uses OAuth-based delegation to let a person grant third-party applications access to their own records. If those records include account data, the systems holding them stay in scope and Requirement 7 still limits every party's access to business need to know; the protocol on its own meets no requirement.
Related. OAuth, Authorization, Federated Identity, Access Control, Consumer
Sources. PCI DSS v4.0.1 (June 2024)