8.1.4 Are inactive user accounts either removed or disabled Review password procedures within 90 days? Observe user accounts Are accounts used by vendors to access, support, 8.1.5 Review password procedures or maintain system components via remote access Interview personnel enabled only during the time period needed and Observe processes disabled when not in use? Are vendor remote access accounts monitored Interview personnel when in use? Observe processes Are repeated access attempts limited by locking out 8.1.6 Review password procedures the user ID after no more than six attempts? Examine system configuration settings This testing procedure applies only to service providers. 8.1.7 Once a user account is locked out, is the lockout Review password procedures duration set to a minimum of 30 minutes or an Examine system configuration administrator enables the user ID? settings 8.1.8 If a session has been idle for more than 15 minutes, are Review password procedures users required to re-authenticate (for example, re-enter Examine system configuration the password) to re-activate the terminal or session? settings 8.2 In addition to assigning a unique ID, is one or more of Review password procedures the following methods employed to authenticate all Observe authentication processes users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric
8.1.4 Are inactive user accounts either removed or disabled within 90 days? Review password procedures Observe user accounts 8.1.5 Are accounts used by vendors to access, support, or maintain system components via remote access enabled only during the time period needed and disabled when not in use? Review password procedures Interview personnel Observe processes Are vendor remote access accounts monitored when in use? Interview personnel Observe processes 8.1.6 Are repeated access attempts limited by locking out the user ID after no more than six attempts? Review password procedures Examine system configuration settings This testing procedure applies only to service providers. 8.1.7 Once a user account is locked out, is the lockout duration set to a minimum of 30 minutes or an administrator enables the user ID? Review password procedures Examine system configuration settings 8.1.8 If a session has been idle for more than 15 minutes, are users required to re-authenticate (for example, re-enter the password) to re-activate the terminal or session? Review password procedures Examine system configuration settings 8.2 In addition to assigning a unique ID, is one or more of the following methods employed to authenticate all users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric Review password procedures Observe authentication processes
PCI_DSS_v3-1_SAQ_D_Merchant_rev1-1.docx