Are user passwords/passphrases changed at least 8.2.4 Review password procedures once every 90 days? Examine system configuration settings This testing procedure applies only to service providers. Must an individual submit a new 8.2.5 Review password procedures password/passphrase that is different from any of the Sample system components last four passwords/passphrases he or she has Examine system configuration used? settings This testing procedure applies only to service providers. 8.2.6 Are passwords/passphrases set to a unique value for Review password procedures each user for first-time use and upon reset, and must Examine system configuration each user change their password immediately after the settings first use? Observe security personnel 8.3 Is all individual non-console administrative access and all remote access to the CDE secured using multi-factor authentication as follows: Note: Multi-factor authentication requires that a minimum of two of the three authentication methods (see PCI DSS Requirement 8.2 for descriptions of authentication methods) be used for authentication. Using one factor twice (for example, using two separate passwords) is not considered multi-factor authentication. 8.3.1 Is authentication incorporated for all Examine system configurations access into the CDE for personnel with Observe administrator logging administrative access? into CDE Note: This requirement is a best practice January 31, 2018, after which it becomes a requirement.
8.2.4 Are user passwords/passphrases changed at least once every 90 days? Review password procedures Examine system configuration settings This testing procedure applies only to service providers. 8.2.5 Must an individual submit a new password/passphrase that is different from any of the last four passwords/passphrases he or she has used? Review password procedures Sample system components Examine system configuration settings This testing procedure applies only to service providers. 8.2.6 Are passwords/passphrases set to a unique value for each user for first-time use and upon reset, and must each user change their password immediately after the first use? Review password procedures Examine system configuration settings Observe security personnel 8.3 Is all individual non-console administrative access and all remote access to the CDE secured using multi-factor authentication as follows: Note: Multi-factor authentication requires that a minimum of two of the three authentication methods (see PCI DSS Requirement 8.2 for descriptions of authentication methods) be used for authentication. Using one factor twice (for example, using two separate passwords) is not considered multi-factor authentication. 8.3.1 Is authentication incorporated for all access into the CDE for personnel with administrative access? Note: This requirement is a best practice January 31, 2018, after which it becomes a requirement. Examine system configurations Observe administrator logging into CDE
PCI-DSS-v3_2-SAQ-D_Merchant-rev1_1.docx