PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/127 of 250
8.3.8Strong authentication for users and administrators is established and managed
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
Authentication policies and procedures are documented and communicated to all users, including:
- Guidance on selecting strong authentication factors.
- Guidance for how users should protect their authentication factors.
- Instructions do not reuse previously used passwords or passphrases.
- Instructions to change passwords or passphrases if there is any suspicion or knowledge that the passwords or passphrases have been compromised and how to report the incident.
Defined Approach Testing Procedures:
8.3.8.a Examine procedures and interview personnel to verify that authentication policies and procedures are distributed to all users.
8.3.8.b Review authentication policies and procedures that are distributed to users and verify that they include the elements specified in this requirement.
8.3.8.c Interview users to verify that they are familiar with authentication policies and procedures.