Are all users assigned a unique ID before allowing them to 8.1.1 Review password procedures access system components or cardholder data? Interview personnel Are accounts used by third parties to access, support, 8.1.5 Review password procedures or maintain system components via remote access Interview personnel enabled only during the time period needed and Observe processes disabled when not in use? Are third party remote access accounts monitored Interview personnel when in use? Observe processes (a) Are repeated access attempts limited by locking out 8.1.6 Review password procedures the user ID after no more than six attempts? Examine system configuration settings Once a user account is locked out, is the lockout duration 8.1.7 Review password procedures set to a minimum of 30 minutes or until an administrator Examine system configuration enables the user ID? settings If a session has been idle for more than 15 minutes, are 8.1.8 Review password procedures required to re-authenticate (for example, re-enter the Examine system configuration password) to re-activate the terminal or session? settings 8.2 In addition to assigning a unique ID, is one or more of the Review password procedures following methods employed to authenticate all users? Observe authentication processes Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric
8.1.1 Are all users assigned a unique ID before allowing them to access system components or cardholder data? Review password procedures Interview personnel 8.1.5 Are accounts used by third parties to access, support, or maintain system components via remote access enabled only during the time period needed and disabled when not in use? Review password procedures Interview personnel Observe processes Are third party remote access accounts monitored when in use? Interview personnel Observe processes 8.1.6 (a) Are repeated access attempts limited by locking out the user ID after no more than six attempts? Review password procedures Examine system configuration settings 8.1.7 Once a user account is locked out, is the lockout duration set to a minimum of 30 minutes or until an administrator enables the user ID? Review password procedures Examine system configuration settings 8.1.8 If a session has been idle for more than 15 minutes, are required to re-authenticate (for example, re-enter the password) to re-activate the terminal or session? Review password procedures Examine system configuration settings 8.2 In addition to assigning a unique ID, is one or more of the following methods employed to authenticate all users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric Review password procedures Observe authentication processes
pci-dss-v3_2-saq-c-rev1_1.docx