Notifications
Clear all
Topic starter
12/06/2026 1:12 am
TL;DR: PCI DSS access control requirements tie cardholder-data protection to least privilege, unique IDs, JIT access, and approval controls, while the Target breach example shows how third-party credential abuse can turn a governance gap into a large-scale incident, according to Zluri. The deeper issue is that payment-data security fails when access is managed as a static permission problem instead of a lifecycle and entitlement problem.
NHIMG editorial — based on content published by Zluri: Access Management 6 PCI DSS Controls & Their Requirements
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: What breaks when PCI DSS access control is treated as a one-time policy exercise?
A: Access remains usable after the original business need has ended, which is how overprivileged identities become breach paths.
Q: Why do service accounts and vendor credentials increase PCI DSS risk?
A: Service accounts and vendor credentials often bypass normal user oversight, yet they can still reach cardholder data, databases, and administrative interfaces.
Q: How do security teams know whether PCI access controls are actually working?
A: They should look for evidence that access is scoped, approved, time-bound, and removed on schedule.
Practitioner guidance
- Map every cardholder-data path to a named identity owner Inventory human accounts, service accounts, API credentials, and vendor-linked identities that can reach CHD.
- Enforce business-need access with time-bound approvals Replace standing access with task-scoped approvals for systems that store or process CHD.
- Eliminate default credentials and shared accounts Change all vendor-supplied defaults before deployment and remove shared logins from CHD environments.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- Requirement-by-requirement explanations for all six PCI DSS controls and how they map to payment-data protection.
- Examples of access control patterns such as role-based access, just-in-time access, and least-privilege enforcement in practical settings.
- The article's walkthrough of encryption, vulnerability management, and policy maintenance requirements for cardholder-data environments.
- Implementation detail on using automated access review workflows to support PCI evidence collection and remediation.
👉 Read Zluri's guide to PCI DSS access control controls and requirements →
PCI DSS access control controls: what IAM teams need to know?
Explore further
12/06/2026 10:58 am
PCI DSS access control is really an identity lifecycle problem, not a policy problem. The article correctly ties cardholder-data protection to role-based access, JIT access, and approval workflows, but those controls only work when access is scoped, reviewed, and removed on time. In practice, the programme fails when entitlement lifecycle management is treated as administrative overhead rather than the control that keeps payment data off-limits. Practitioners should judge PCI readiness by whether access can be proven to expire, not by whether a policy exists.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, which is why access lifecycle control remains a persistent weak point.
A question worth separating out:
Q: Who is accountable when third-party access reaches cardholder data?
A: Accountability sits with the organisation that granted the access and the teams that own the lifecycle of that entitlement. Third-party relationships do not transfer governance responsibility. Under PCI DSS, the business must still prove that access was authorized, monitored, and revoked when the need ended.
👉 Read our full editorial: PCI DSS access control controls expose the NHI governance gap
