8.3.1 Is multi-factor authentication incorporated for all Examine system configurations access into the CDE for personnel with Observe personnel administrator administrative access? logging into CDE Note: This requirement is a best practice until January 31, 2018, after which it becomes a requirement. 8.3.2 Is multi-factor authentication incorporated for all remote Examine system configurations network access (both user and administrator, and Observe personnel connecting including third party access for support or maintenance) remotely originating from outside the entity’s network? 8.4 (a) Are authentication policies and procedures Review policies and procedures documented and communicated to all users? Review distribution method Interview personnel Interview users (b) Do authentication policies and procedures include the Review policies and procedures following? Review documentation provided to Guidance on selecting strong authentication credentials Guidance for how users should protect their authentication credentials Instructions not to reuse previously used passwords Instructions that users should change passwords if there is any suspicion the password could be compromised
8.3.1 Is multi-factor authentication incorporated for all access into the CDE for personnel with administrative access? Note: This requirement is a best practice until January 31, 2018, after which it becomes a requirement. Examine system configurations Observe personnel administrator logging into CDE 8.3.2 Is multi-factor authentication incorporated for all remote network access (both user and administrator, and including third party access for support or maintenance) originating from outside the entity’s network? Examine system configurations Observe personnel connecting remotely 8.4 (a) Are authentication policies and procedures documented and communicated to all users? Review policies and procedures Review distribution method Interview personnel Interview users (b) Do authentication policies and procedures include the following? Guidance on selecting strong authentication credentials Guidance for how users should protect their authentication credentials Instructions not to reuse previously used passwords Instructions that users should change passwords if there is any suspicion the password could be compromised Review policies and procedures Review documentation provided to
pci-dss-v3_2-saq-c-rev1_1.docx