PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/126 of 250
8.3.7Strong authentication for users and administrators is established and managed
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
Individuals are not allowed to submit a new password/passphrase that is the same as any of the last four passwords/passphrases used.
Defined Approach Testing Procedures:
8.3.7 Examine system configuration settings to verify that password parameters are set to require that new passwords/passphrases cannot be the same as the four previously used passwords/passphrases.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.