8.2 In addition to assigning a unique ID, is one or more of the Review password procedures following methods employed to authenticate all users? Observe authentication Something you know, such as a password or processes passphrase Something you have, such as a token device or smart card Something you are, such as a biometric Is strong cryptography used to render all 8.2.1 Review password procedures authentication credentials (such as Review vendor documentation passwords/passphrases) unreadable during Examine system configuration transmission and storage on all system components? settings Observe password files Observe data transmissions This testing procedure applies only to service providers. 8.2.2 Is user identity verified before modifying any Review authentication authentication credential (for example, performing procedures password resets, provisioning new tokens, or generating Observe personnel new keys)? Are user password parameters configured to require 8.2.3 Examine system configuration passwords/passphrases meet the following? settings to verify password parameters A minimum password length of at least seven characters Contain both numeric and alphabetic characters Alternatively, the passwords/passphrases must have complexity and strength at least equivalent to the parameters specified above. This testing procedure applies only to service providers.
8.2 In addition to assigning a unique ID, is one or more of the following methods employed to authenticate all users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric Review password procedures Observe authentication processes 8.2.1 Is strong cryptography used to render all authentication credentials (such as passwords/passphrases) unreadable during transmission and storage on all system components? Review password procedures Review vendor documentation Examine system configuration settings Observe password files Observe data transmissions This testing procedure applies only to service providers. 8.2.2 Is user identity verified before modifying any authentication credential (for example, performing password resets, provisioning new tokens, or generating new keys)? Review authentication procedures Observe personnel 8.2.3 Are user password parameters configured to require passwords/passphrases meet the following? A minimum password length of at least seven characters Contain both numeric and alphabetic characters Alternatively, the passwords/passphrases must have complexity and strength at least equivalent to the parameters specified above. Examine system configuration settings to verify password parameters This testing procedure applies only to service providers.
PCI-DSS-v3_2-SAQ-D_Merchant-rev1_1.docx