PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/128 of 250
8.3.9Strong authentication for users and administrators is established and managed
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
If passwords/passphrases are used as the only authentication factor for user access (i.e., in any single-factor authentication implementation), then either:
- Passwords and passphrases are changed at least once every 90 days, Or
- The security posture of accounts is dynamically analyzed, and real-time access to resources is automatically determined accordingly.
Defined Approach Testing Procedures:
8.3.9 If passwords/passphrases are used as the only authentication factor for user access, inspect system configuration settings to verify that passwords/passphrases are managed in accordance with ONE of the elements specified in this requirement.