8.3.2 Is multi-factor authentication incorporated for all remote Examine system configurations network access (both user and administrator, and Observe personnel connecting including third party access for support or maintenance) remotely originating from outside the entity’s network? Are authentication policies and procedures 8.4 Review policies and procedures documented and communicated to all users? Review distribution method Interview personnel Interview users Do authentication policies and procedures include the Review policies and procedures following? Review documentation provided Guidance on selecting strong authentication to users credentials Guidance for how users should protect their authentication credentials Instructions not to previously used passwords Instructions that users should change passwords if there is any suspicion the password could be compromised 8.5 Are shared, or generic accounts, passwords, or Review policies and procedures other authentication methods prohibited as follows: Examine user ID lists Generic user IDs and accounts are disabled or Interview personnel removed; Shared user IDs for system administration activities and critical functions do not exist; and Shared and generic user IDs are not used to administer any system components? 8.5.1 This requirement applies only to service providers.
8.3.2 Is multi-factor authentication incorporated for all remote network access (both user and administrator, and including third party access for support or maintenance) originating from outside the entity’s network? Examine system configurations Observe personnel connecting remotely 8.4 Are authentication policies and procedures documented and communicated to all users? Review policies and procedures Review distribution method Interview personnel Interview users Do authentication policies and procedures include the following? Guidance on selecting strong authentication credentials Guidance for how users should protect their authentication credentials Instructions not to previously used passwords Instructions that users should change passwords if there is any suspicion the password could be compromised Review policies and procedures Review documentation provided to users 8.5 Are shared, or generic accounts, passwords, or other authentication methods prohibited as follows: Generic user IDs and accounts are disabled or removed; Shared user IDs for system administration activities and critical functions do not exist; and Shared and generic user IDs are not used to administer any system components? Review policies and procedures Examine user ID lists Interview personnel 8.5.1 This requirement applies only to service providers.