PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/134 of 250
8.4.3Multi-factor authentication (MFA) is implemented to secure access into the CDE
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
The MFA is implemented for all remote network access originating from outside the entity's network that could access or impact the CDE as follows:
- All remote access by all personnel, both users and administrators, originating from outside the entity's network.
- All remote access by third parties and vendors.
Defined Approach Testing Procedures:
8.4.3.a Examine network and/or system configurations for remote access servers and systems to verify MFA is required in accordance with all elements specified in this requirement.
8.4.3.b Observe personnel (for example, users and administrators) connecting remotely to the network and verify that multi-factor authentication is required.