PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/115 of 250
8.2.4User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycle
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
Addition, deletion, and modification of user IDs, authentication factors, and other identifier objects are managed as follows:
- Authorized with the appropriate approval.
- Implemented with only the privileges specified in the documented approval.
Defined Approach Testing Procedures:
8.2.4 Examine documented authorizations across various phases of the account lifecycle (additions, modifications, and deletions) and examine system settings to verify the activity has been managed in accordance with all elements specified in this requirement.