8.6.3Use of application and system accounts and associated authentication factors is strictly managed

Defined Approach Requirements:

Passwords and passphrases for any application and system accounts are protected against misuse as follows:

- Passwords and passphrases are changed periodically (at the frequency defined in the entity's targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1) and upon suspicion or confirmation of compromise.

- Passwords are constructed with sufficient complexity appropriate for how frequently the entity changes the passwords.

Defined Approach Testing Procedures:

8.6.3.a Examine policies and procedures to verify that procedures are defined to protect passwords or passphrases for application or system accounts against misuse in accordance with all elements specified in this requirement.

8.6.3.b Examine the entity's targeted risk analysis for the change frequency and complexity of passwords/passphrases used for interactive login to application and system accounts to verify the risk analysis was performed in accordance with all elements specified in Requirement 12.3.1 and addresses:

- The frequency defined for periodic changes to application and system passwords and passphrases

- The complexity defined for passwords and the appropriateness of the complexity relative to the frequency of changes.

8.6.3.c Interview responsible personnel and examine system configuration settings to verify that passwords/passphrases for any application and system accounts that can be used for interactive login are protected against misuse in accordance with all elements specified in this requirement.