Please answer these simple 10 questions.

This survey will help determine if your security and governance would improve with YouAttest.

Does your organization implement an access control model that enforces least privilege for all users? PCI DSS Standard 7.2.1

Yes

An access control model is defined and documented, incorporating least privilege and a default deny-all setting.

Are access permissions assigned based on job classification and function? PCI DSS Standard 7.2.2

Yes

Access controls are limited by job classification and function, adhering to least privilege principles.

Are all user accounts, including third-party accounts, reviewed at least every six months to ensure appropriateness? PCI DSS Standard 7.2.4

Yes

All user accounts and access privileges, including third-party accounts, are reviewed at least every six months.

Do system and application accounts have the minimum privileges necessary for their functions? PCI DSS Standard 7.2.5

Yes

Application and system accounts have the least privileges necessary and are limited to required systems or processes.

Are periodic reviews of application and system account access conducted based on risk analysis? PCI DSS Standard 7.2.5.1

Yes

Application and system account accesses are reviewed periodically based on risk analysis, with management sign-off.

Is access to query cardholder data repositories restricted to roles with least privilege? PCI DSS Standard 7.2.6

Yes

User access to query repositories containing cardholder data is restricted to roles with least privileges, primarily via applications.

Is access to the cardholder data environment reviewed every three months for high-risk systems? PCI DSS Standard 7.3.1

Yes

All access to databases with cardholder data and remote access to the cardholder data environment is reviewed every three months.

Are user accounts and privileges reviewed every six months to confirm business justification? PCI DSS Standard 7.3.2

Yes

All user accounts and privileges are reviewed every six months to confirm business justification and address inappropriate access.

Are roles and responsibilities for user authentication activities clearly defined and assigned? PCI DSS Standard 8.1.2

Yes

Roles and responsibilities for user identification and authentication activities are documented, assigned, and understood.

Are third-party IDs accessing the cardholder data environment reviewed every three months? PCI DSS Standard 8.2.3

Yes

Third-party IDs for accessing the cardholder data environment are reviewed every three months and properly authenticated.

Full Name *

Email *

Phone *

Business *

GRC Partner Email(Optional)