Requirement 8: Identify and authenticate access to system components Response one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A Are all assigned a unique ID before allowing them 8.1.1 Review password procedures to access system components or cardholder data? Interview personnel [You will need to include your procedure in the merchant procedures you provide as evidence with your SAQ submission.] Is access for any terminated immediately 8.1.3 Review password procedures deactivated or removed? Examine terminated users accounts Review current access Observe returned physical authentication devices [You will need to include your procedure in the merchant procedures you provide as evidence with your SAQ submission.] 8.2 In addition to assigning a unique ID, is one or more of Review password procedures the following methods employed to authenticate all Observe authentication processes users? [Yes, for TouchNet. Managed centrally. If Something you know, such as a password or TouchNet, you do not need to include in passphrase your merchant procedures.] Something you have, such as a token device or [If not using TouchNet, ensure your smart card 3rd party vendor meets this Something you are, such as a biometric requirement and include your procedure in the merchant procedures you provide as evidence with your SAQ submission.]
Requirement 8: Identify and authenticate access to system components PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 8.1.1 Are all assigned a unique ID before allowing them to access system components or cardholder data? Review password procedures Interview personnel [You will need to include your procedure in the merchant procedures you provide as evidence with your SAQ submission.] 8.1.3 Is access for any terminated immediately deactivated or removed? Review password procedures Examine terminated users accounts Review current access Observe returned physical authentication devices [You will need to include your procedure in the merchant procedures you provide as evidence with your SAQ submission.] 8.2 In addition to assigning a unique ID, is one or more of the following methods employed to authenticate all users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric Review password procedures Observe authentication processes [Yes, for TouchNet. Managed centrally. If TouchNet, you do not need to include in your merchant procedures.] [If not using TouchNet, ensure your 3rd party vendor meets this requirement and include your procedure in the merchant procedures you provide as evidence with your SAQ submission.]
pci-dss-v3_2-saq-a_instr.docx