8.3 Is all individual non-console administrative access and all remote access to the CDE secured using factor authentication, as follows: Note: Multi-factor authentication requires that a minimum of two of the three authentication methods (see PCI DSS Requirement 8.2 for descriptions of authentication methods) be used for authentication. Using one twice (for example, using two separate passwords) is not considered multi-factor authentication. 8.3.2 Is multi-factor authentication incorporated for all Examine system configurations remote network access (both user and administrator, Observe personnel connecting and including third party access for support and remotely maintenance) originating from outside the entity’s network? 8.5 Are group, shared, or generic accounts, passwords, or Review policies and procedures other authentication methods prohibited as follows: Examine user ID lists Generic user IDs and accounts are disabled or Interview personnel removed; Shared user IDs for system administration activities and other critical functions do not exist; and Shared and generic user IDs are not used to administer any system components Requirement 9: Restrict physical access to cardholder data Response PCI DSS Question Expected Testing (Check one response for each question)
8.3 Is all individual non-console administrative access and all remote access to the CDE secured using authentication, as follows: Note: Multi-factor authentication requires that a minimum of two of the three authentication methods (see PCI DSS Requirement 8.2 for descriptions of authentication methods) be used for authentication. Using one factor twice (for example, using two separate passwords) is not considered multi-factor authentication. 8.3.2 Is multi-factor authentication incorporated for all remote network access (both user and administrator, and including third party access for support and maintenance) originating from outside the entity’s network? Examine system configurations Observe personnel connecting remotely 8.5 Are group, shared, or generic accounts, passwords, or other authentication methods prohibited as follows: Generic user IDs and accounts are disabled or removed; Shared user IDs for system administration activities and other critical functions do not exist; and Shared and generic user IDs are not used to administer any system components Review policies and procedures Examine user ID lists Interview personnel Requirement 9: Restrict physical access to cardholder data PCI DSS Question Expected Testing Response (Check one response for each question)
SAQ_B-IP.docx