PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/119 of 250
8.2.8User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycle
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session.
Defined Approach Testing Procedures:
8.2.8 Examine system configuration settings to verify that system/session idle timeout features for user sessions have been set to 15 minutes or less.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.