Identify users and authenticate access
Requirement 8 asks one thing of every system in scope: know who each person is, and make them prove it. Shared logins, forgotten accounts and a password on its own are where that breaks.
One of the most evidence-heavy chapters: the answers sit in settings screens, account lists and the memory of the people who run them.
#What PCI asks
- One ID per person, so each action traces to one individual.
- Accounts approved when added or changed, and removed when someone leaves or stops using them.
- Factors hard to steal or guess, and more than one for anything sensitive.
- Checking systems that are hard to replay or bypass.
- System and application accounts held to the same standard as people's.
- 8.1As in every requirement: documented policies and procedures, and roles people understand.
#The sub-requirements, grouped
Paraphrased from PCI DSS v4.0.1. The standard's own wording governs.
Identification and the account lifecycle
- Unique ID per user
- Shared or generic IDs only by exception
- Additions and changes authorized
- Leavers removed at once
- Unused 90 days: removed or disabled
- Third-party remote access enabled only when needed
- Idle 15 minutes: sign in again
Strong authentication
- At least one factor per user
- Factors unreadable in storage and transit
- Lockout after 10 failed tries at most
- 12 characters or more, letters and numbers
- Not one of the last four
- Single-factor: changed every 90 days or checked continuously
- Tokens kept to one person
Where multi-factor is required
- Non-console admin access into the CDE
- All non-console access into the CDE
- All remote access from outside the entity's network
How multi-factor systems are set up
- Not open to replay
- No bypass without a documented, time-limited exception
- Two different kinds of factor
- Every factor must succeed
System and application accounts
- Interactive login only when needed and approved
- No passwords hard-coded in scripts or files
- Passwords changed on a schedule set by risk analysis
#What the assessor examines
Settings and records, often on a sample, and the people who run them. Each method is its own record.
Four methods
ExaminePassword, lockout and idle settings; user lists against leaver records; multi-factor setup.
Accepting a result records the examination of its cited passages.InterviewAdmins and the people who grant access, as on third-party remote access in
8.2.7.Points quote exact words, with speaker and time.ObserveA sign-in with a second factor, or a session locking when idle.
Always the assessor's own entry, never in a batch.SampleComponents and user accounts by a repeatable random draw.
Each set lists its members; testing names the ones it covered.
Deeper: Sampling and interviews, in Assess
#How 8.3.6 runs in Enpasse
Passwords of a minimum length and mix, for Northwind Retail. Enpasse suggests and cites. Maria Reyes, Lead QSA, decides.
The gap is raised; never a guess
Please send an export or screenshot of the admin console's password settings, showing the minimum length and the character rules.
EV-031 admin console settingsp. 2
Password policy: minimum length 12 characters; must contain letters and numbers.
Password policy: minimum length 12 characters; must contain letters and numbers.
Synthetic data. In Write, the 8.3.6 narrative is drafted with each sentence cited to the same settings; she accepts or rewrites it.
#Common evidence types
What clients usually send. Each file gets one number; every result cites its passage, page, rows or region.
EVAuthentication settingsPassword, lockout and idle-session exports or screenshotsEVUser and account listsEvery account by system, with owners, roles and last sign-inEVJoiner and leaver recordsHR changes matched against access removalEVMulti-factor configurationWhich access paths need it, and the factor typesEVRemote and third-party accessVendor accounts, when enabled, how watchedEVSystem and application accountsInventory, justifications, how passwords are storedEVPolicies and proceduresAuthentication and identity management, with rolesINTInterview recordsAdministrator notes, each quote opening at its lines
Enpasse holds itself to this chapter
- 12 characters or more, letters and numbers
- A second step nobody can turn off, admins included
- 10 failed tries pause sign-in
- 15 idle minutes end the session
PCI DSS is a trademark of PCI Security Standards Council, LLC. PCI SSC does not endorse third-party products. Enpasse is designed to align with PCI SSC's published standards and guidance; this chapter paraphrases the standard and does not quote it.