PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/135 of 250
8.5.1Multi-factor authentication (MFA) systems are configured to prevent misuse
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
MFA systems are implemented as follows:
- The MFA system is not susceptible to replay attacks.
- MFA systems cannot be bypassed by any users, including administrative users, unless specifically documented, and authorized by management on an exception basis, for a limited time period.
- At least two different types of authentication factors are used.
- Success of all authentication factors is required before access is granted.
Defined Approach Testing Procedures:
8.5.1.a Examine vendor system documentation to verify that the MFA system is not susceptible to replay attacks.
8.5.1.b Examine system configurations for the MFA implementation to verify it is configured in accordance with all elements specified in this requirement.
8.5.1.c Interview responsible personnel and observe processes to verify that any requests to bypass MFA are specifically documented and authorized by management on an exception basis, for a limited time period.
8.5.1.d Observe personnel logging into system components in the CDE to verify that access is granted only after all authentication factors are successful.
8.5.1.e Observe personnel connecting remotely from outside the entity's network to verify that access is granted only after all authentication factors are successful.