8.1.3 Is access for any terminated users immediately Review password procedures deactivated or removed? Examine terminated users accounts Review current access lists Observe returned physical authentication devices 8.1.4 Are inactive user accounts either removed or disabled Review password procedures within 90 days? Observe user accounts Are accounts used by third parties to access, 8.1.5 Review password procedures support, or maintain system components via remote Interview personnel access enabled only during the time period needed Observe processes and disabled when not in use? Are third party remote access accounts monitored Interview personnel when in use? Observe processes Are repeated access attempts limited by locking out 8.1.6 Review password procedures the user ID after no more than six attempts? Examine system configuration settings This testing procedure applies only to service providers. 8.1.7 Once a user account is locked out, is the lockout duration Review password procedures set to a minimum of 30 minutes or until an administrator Examine system configuration enables the user ID? settings 8.1.8 If a session has been idle for more than 15 minutes, are Review password procedures users required to re-authenticate (for example, re-enter Examine system configuration the password) to re-activate the terminal or session? settings
8.1.3 Is access for any terminated users immediately deactivated or removed? Review password procedures Examine terminated users accounts Review current access lists Observe returned physical authentication devices 8.1.4 Are inactive user accounts either removed or disabled within 90 days? Review password procedures Observe user accounts 8.1.5 Are accounts used by third parties to access, support, or maintain system components via remote access enabled only during the time period needed and disabled when not in use? Review password procedures Interview personnel Observe processes Are third party remote access accounts monitored when in use? Interview personnel Observe processes 8.1.6 Are repeated access attempts limited by locking out the user ID after no more than six attempts? Review password procedures Examine system configuration settings This testing procedure applies only to service providers. 8.1.7 Once a user account is locked out, is the lockout duration set to a minimum of 30 minutes or until an administrator enables the user ID? Review password procedures Examine system configuration settings 8.1.8 If a session has been idle for more than 15 minutes, are users required to re-authenticate (for example, re-enter the password) to re-activate the terminal or session? Review password procedures Examine system configuration settings
PCI-DSS-v3_2-SAQ-D_Merchant.docx