8.3 Is two-factor authentication incorporated for remote Review policies and procedures network access originating from outside the network by Examine system configurations personnel (including users and administrators) and all Observe personnel third parties (including vendor access for support or maintenance)? Note: Two-factor authentication requires that two of the three authentication methods (see PCI DSS Requirement 8.2 for descriptions of authentication methods) be used for authentication. Using one factor twice (for example, using two separate passwords) is not considered two-factor authentication. Examples of two-factor technologies include remote authentication and dial-in service (RADIUS) with tokens; terminal access controller access control system (TACACS) with tokens; and technologies that facilitate two-factor authentication. Are authentication procedures and policies 8.4 Review policies and procedures documented and communicated to all Review distribution method Interview personnel Interview users Do authentication procedures and policies include Review policies and procedures the following? Review documentation provided Guidance on selecting strong authentication to users credentials Guidance for how should protect their authentication credentials Instructions not to reuse previously used passwords Instructions that users should change passwords if there is any suspicion the password could be compromised
8.3 Is two-factor authentication incorporated for remote network access originating from outside the network by personnel (including users and administrators) and all third parties (including vendor access for support or maintenance)? Note: Two-factor authentication requires that two of the three authentication methods (see PCI DSS Requirement 8.2 for descriptions of authentication methods) be used for authentication. Using one factor twice (for example, using two separate passwords) is not considered two-factor authentication. Examples of two-factor technologies include remote authentication and dial-in service (RADIUS) with tokens; terminal access controller access control system (TACACS) with tokens; and technologies that facilitate two-factor authentication. Review policies and procedures Examine system configurations Observe personnel 8.4 Are authentication procedures and policies documented and communicated to all Review policies and procedures Review distribution method Interview personnel Interview users Do authentication procedures and policies include the following? Guidance on selecting strong authentication credentials Guidance for how should protect their authentication credentials Instructions not to reuse previously used passwords Instructions that users should change passwords if there is any suspicion the password could be compromised Review policies and procedures Review documentation provided to users