7.2 Establish a mechanism for systems with multiple users that restricts access based on a user's need to know, and is set to deny-all unless specifically allowed.

[admin]

7.2 Establish an access control system for systems components with multiple users that restricts access based on a user's need to know, and is set to "deny all" unless specifically allowed.
This access control system must include the following:

• 7.2.1 Coverage of all system components
• 7.2.2 Assignment of privileges to individuals based on job classification and function
• 7.2.3 Default "deny-all" setting

Examine system settings and vendor documentation to verify that an access control system is implemented as follows:

• 7.2.1 Confirm that access control systems are in place on all system components.
• 7.2.2 Confirm that access control systems are configured to enforce privileges assigned to individuals based on job classification and function.
• 7.2.3 Confirm that the access control systems has a default "deny-all" setting.

Note: Some access control systems are set by default to "allow-all", thereby permitting access unless/until a rule is written to specifically deny it.