PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/130 of 250
8.3.10.1Strong authentication for users and administrators is established and managed
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
Additional requirements for service providers only:
If passwords/passphrases are used as the only authentication factor for customer user access (i.e., in any single-factor authentication implementation), then either:
- Passwords and passphrases are changed at least once every 90 days, Or
- The security posture of accounts is dynamically analyzed, and real-time access to resources is automatically determined accordingly.
Defined Approach Testing Procedures:
8.3.10.1 Additional testing procedure for service provider assessments only: If passwords or passphrases are used as the only authentication factor for customer user access, inspect system configuration settings to verify that passwords or passphrases are managed in accordance with one of the elements specified in this requirement.