PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/136 of 250
8.6.1Use of application and system accounts and associated authentication factors is strictly managed
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
If accounts used by systems or applications can be used for interactive login, they are managed as follows:
- Interactive use is prevented unless needed for an exceptional circumstance.
- Interactive use is limited to the time needed for exceptional circumstances.
- Business justification for interactive use is documented.
- Interactive use is explicitly approved by management.
- Individual user identity is confirmed before access to account is granted.
- Every action taken is attributable to an individual user.
Defined Approach Testing Procedures:
8.6.1 Examine application and system accounts that can be used interactively and interview administrative personnel to verify that application and system accounts are managed in accordance with all elements specified in this requirement.