PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/137 of 250
8.6.2Use of application and system accounts and associated authentication factors is strictly managed
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
Passwords/passphrases for any application and system accounts that can be used for interactive login are not hard coded in scripts, configuration/property files, or bespoke and custom source code.
Defined Approach Testing Procedures:
8.6.2.a Interview personnel and examine system development procedures to verify that processes are defined for application and system accounts that can be used for interactive login, specifying that passwords/passphrases are not hard coded in scripts, configuration/property files, or bespoke and custom source code.
8.6.2.b Examine scripts, configuration/property files, and bespoke and custom source code for application and system accounts that can be used for interactive login, to verify passwords/passphrases for those accounts are not present.