Do authentication policies and procedures include Review policies and procedures the following? Review documentation provided Guidance on selecting strong authentication to credentials Guidance for how users should protect their authentication credentials Instructions not to previously used passwords Instructions that users should change passwords if there is any suspicion the password could be compromised 8.5 Are shared, or generic accounts, passwords, or Review policies and procedures other authentication methods prohibited as follows: Examine user ID Generic user IDs and accounts are disabled or Interview personnel removed; Shared user IDs for system administration activities and other critical functions do not exist; and Shared and generic user IDs are not used to administer any system components? 8.5.1 This requirement applies only to service providers. 8.6 Where other authentication mechanisms are used (for Review policies and procedures example, physical or logical security tokens, smart cards, Interview personnel and certificates, etc.), is the use of these mechanisms Examine system configuration assigned as follows? settings and/or physical controls Authentication mechanisms must be assigned to an individual account and not shared among multiple accounts Physical and/or logical controls must be in place to ensure only the intended account can use that mechanism to gain access
Do authentication policies and procedures include the following? Guidance on selecting strong authentication credentials Guidance for how users should protect their authentication credentials Instructions not to previously used passwords Instructions that users should change passwords if there is any suspicion the password could be compromised Review policies and procedures Review documentation provided to 8.5 Are shared, or generic accounts, passwords, or other authentication methods prohibited as follows: Generic user IDs and accounts are disabled or removed; Shared user IDs for system administration activities and other critical functions do not exist; and Shared and generic user IDs are not used to administer any system components? Review policies and procedures Examine user ID Interview personnel 8.5.1 This requirement applies only to service providers. 8.6 Where other authentication mechanisms are used (for example, physical or logical security tokens, smart cards, and certificates, etc.), is the use of these mechanisms assigned as follows? Authentication mechanisms must be assigned to an individual account and not shared among multiple accounts Physical and/or logical controls must be in place to ensure only the intended account can use that mechanism to gain access Review policies and procedures Interview personnel Examine system configuration settings and/or physical controls
PCI_DSS_v3-1_SAQ_D_Merchant_rev1-1.docx