Should organisations treat PCI DSS self-assessments as an identity governance exercise?

How PCI DSS self-assessments become an access-control evidence exercise

A self-assessment is only defensible if the organisation can prove who can reach cardholder data, why they can reach it, and whether that access is still justified. That means the assessment is not just a questionnaire, it is an evidence pull from identity, access, and review processes. If the access story is weak, the self-assessment is weak, even if the technical answers look complete.

For payment environments, the control question is less “do we have a policy?” and more “can we show current entitlements, business ownership, and review outcomes for every relevant account?” That is why PCI DSS v4.0 matters here: access restriction and account-use expectations push organisations toward evidence-backed access governance, not paper compliance.

identity governance gives the assessor something verifiable: access approvals, recertification results, removal records, and ownership assignments. Without those artefacts, a self-assessment can confirm intent but not control operation.

Why identity governance is part of the compliance control set

PCI DSS self-assessments are credible only when the organisation can demonstrate that access is current, limited, and reviewed. In practice, that depends on identity governance processes such as access certification, role ownership, entitlement scoping, and remediation tracking. If those processes are outside the compliance workflow, the organisation usually ends up answering the questionnaire from memory instead of evidence.

This is especially important where access changes frequently or where multiple teams share responsibility for cardholder data systems. A self-assessment can quickly become stale if there is no closed loop between access review findings and actual entitlement removal. For that reason, Access Reviews and Certification Guide is a useful companion for turning review activity into audit-ready proof.

Good governance also means distinguishing between standing access and exceptional access. If a user, admin, or service account has broad or persistent access without a current business need, the self-assessment should not treat that as a documentation issue. It is a control failure that needs remediation before the response is signed off.

What auditors and assessors actually need to see

The strongest self-assessments show a direct chain from access requirement to approval to review to remediation. Practitioners should expect to produce the owner of the data or system, the list of accounts in scope, the entitlements attached to those accounts, the date of the last review, and evidence that exceptions were removed or formally accepted.

That chain is easier to maintain when the organisation runs identity governance as a recurring operational process rather than as an annual project. The most useful evidence usually comes from the same system of record that manages provisioning, review campaigns, and role changes. IAM and IGA Basics is relevant because it frames that operating model clearly: authenticate, authorise, review, and remove what is no longer justified.

Self-assessments also benefit from clear exception handling. If a business owner accepted a risk temporarily, that exception should have scope, expiry, and compensating control evidence. Otherwise the assessment is describing a permanent control gap as if it were a temporary deviation.

Practitioner Guidance

What to prioritise: Start with the accounts that can reach cardholder data, then separate human, privileged, and non-human access. The first question is not whether the questionnaire is complete, but whether every in-scope account has an owner, a current business need, and a review record that can survive challenge.

What to verify: Verify that remediation is closed loop. If an access review found excessive access, the evidence should show the entitlement was removed or reduced, not merely flagged. A self-assessment that cannot produce closure evidence is exposing a control design weakness, not a missing report.

What good looks like: The assessor can trace each material access path to an approver, a reviewer, and a dated outcome. The organisation can show that reviews are recurring, exceptions are time-bound, and stale or overbroad access is removed before the control relies on user memory.

Practitioner takeaway: Treat the self-assessment as proof of control operation, not a paperwork exercise. If you cannot evidence who had access, why they had it, and what changed after review, you do not yet have a credible PCI DSS self-assessment.

Related resources from NHI Mgmt Group

• What breaks when organisations treat identity compliance as a one-time legal exercise instead of an ongoing governance function?
• How should organisations treat PCI DSS 4.0 as part of an ongoing compliance programme rather than a one-time certification exercise?
• Why is it important to integrate identity and data governance?
• When should organisations treat an NHI as a high-priority risk?