PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/122 of 250
8.3.3Strong authentication for users and administrators is established and managed
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
User identity is verified before modifying any authentication factor.
Defined Approach Testing Procedures:
8.3.3 Examine procedures for modifying authentication factors and observe security personnel to verify that when a user requests a modification of an authentication factor, the user’s identity is verified before the authentication factor is modified.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.