8.6 Where other authentication mechanisms are used (for Review policies and procedures example, physical or logical security tokens, smart cards, Interview personnel and certificates, etc.), is the use of these mechanisms Examine system configuration assigned as follows? settings and/or physical controls Authentication mechanisms must be assigned to an individual account and not shared among multiple accounts Physical and/or logical controls must be in to ensure only the intended account can use that mechanism to gain access 8.7 Is all access to any database containing cardholder data (including access by applications, administrators, and all other users) restricted as follows: Is all user access to, user queries of, and user Review database authentication actions on (for example, move, copy, delete), the policies and procedures database through programmatic methods only (for Examine database and example, through stored procedures)? application configuration settings Is user direct access to or queries to of databases Review database authentication restricted to database administrators? policies and procedures Examine database access control settings Examine database application configuration settings Are application IDs only able to be used by the Review database authentication applications (and not by individual users or other policies and procedures processes)? Examine database access control settings Examine database application configuration settings
8.6 Where other authentication mechanisms are used (for example, physical or logical security tokens, smart cards, and certificates, etc.), is the use of these mechanisms assigned as follows? Authentication mechanisms must be assigned to an individual account and not shared among multiple accounts Physical and/or logical controls must be in to ensure only the intended account can use that mechanism to gain access Review policies and procedures Interview personnel Examine system configuration settings and/or physical controls 8.7 Is all access to any database containing cardholder data (including access by applications, administrators, and all other users) restricted as follows: Is all user access to, user queries of, and user actions on (for example, move, copy, delete), the database through programmatic methods only (for example, through stored procedures)? Review database authentication policies and procedures Examine database and application configuration settings Is user direct access to or queries to of databases restricted to database administrators? Review database authentication policies and procedures Examine database access control settings Examine database application configuration settings Are application IDs only able to be used by the applications (and not by individual users or other processes)? Review database authentication policies and procedures Examine database access control settings Examine database application configuration settings
PCI-DSS-v3_2-SAQ-D_Merchant.docx