PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/131 of 250
8.3.11Strong authentication for users and administrators is established and managed
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
Where authentication factors such as physical or logical security tokens, smart cards, or certificates are used:
- Factors are assigned to an individual user and are not shared among multiple users.
- Physical and/or logical controls ensure only the intended user can use that factor to gain access.
Defined Approach Testing Procedures:
8.3.11.a Examine authentication policies and procedures to verify that procedures for using authentication factors such as physical security tokens, smart cards, and certificates are defined and include all elements specified in this requirement.
8.3.11.b Interview security personnel to verify authentication factors are assigned to an individual user and not shared among multiple users.
8.3.11.c Examine system configuration settings and/or observe physical controls, as applicable, to verify that controls are implemented to ensure only the intended user can use that factor to gain access.