PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/124 of 250
8.3.5Strong authentication for users and administrators is established and managed
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
If passwords or passphrases are used as authentication factors to meet Requirement 8.3.1, they are set and reset for each user as follows:
- Set to a unique value for first-time use and upon reset.
- It is forced to be changed immediately after the first use.
Defined Approach Testing Procedures:
8.3.5 Examine procedures for setting and resetting passwords and passphrases (if used as authentication factors to meet Requirement 8.3.1) and observe security personnel to verify that passwords and passphrases are set and reset in accordance with all elements specified in this requirement.