Requirement 8: Identify and authenticate access to system components Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A Are policies and procedures for user identification 8.1 management controls defined and in place for users and administrators on all system components, as follows: Are all users assigned a unique ID before allowing 8.1.1 Review password procedures them to access system components or cardholder Interview personnel data? Are additions, deletions, and modifications of user 8.1.2 Review password procedures IDs, credentials, and identifier objects controlled Examine privileged and general user such that user IDs are implemented only as IDs and associated authorizations authorized (including with specified privileges)? Observe system settings Is access for any terminated immediately 8.1.3 Review password procedures deactivated or removed? Examine terminated users accounts Review current access lists Observe returned physical authentication devices Are inactive user accounts either removed or disabled 8.1.4 Review password procedures within 90 days? Observe user accounts Are accounts used by third parties to access, 8.1.5 Review password procedures support, or maintain system components via Interview personnel remote access enabled only during the time Observe processes period needed and disabled when not in use? Are third party remote access accounts monitored Interview personnel when in use? Observe processes 8.1.6 (a) Are repeated access attempts limited by locking Review password procedures out the user ID after no more than six attempts? Examine system configuration settings
Requirement 8: Identify and authenticate access to system components PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 8.1 Are policies and procedures for user identification management controls defined and in place for users and administrators on all system components, as follows: 8.1.1 Are all users assigned a unique ID before allowing them to access system components or cardholder data? Review password procedures Interview personnel 8.1.2 Are additions, deletions, and modifications of user IDs, credentials, and identifier objects controlled such that user IDs are implemented only as authorized (including with specified privileges)? Review password procedures Examine privileged and general user IDs and associated authorizations Observe system settings 8.1.3 Is access for any terminated immediately deactivated or removed? Review password procedures Examine terminated users accounts Review current access lists Observe returned physical authentication devices 8.1.4 Are inactive user accounts either removed or disabled within 90 days? Review password procedures Observe user accounts 8.1.5 Are accounts used by third parties to access, support, or maintain system components via remote access enabled only during the time period needed and disabled when not in use? Review password procedures Interview personnel Observe processes Are third party remote access accounts monitored when in use? Interview personnel Observe processes 8.1.6 (a) Are repeated access attempts limited by locking out the user ID after no more than six attempts? Review password procedures Examine system configuration settings
SAQ_A-EP.docx