Requirement 8: Identify and authenticate access to system components Response one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A 8.1.1 Are all users assigned a unique ID before allowing Review password procedures them to access system components or cardholder Interview personnel data? 8.1.3 Is access for any terminated users immediately Review password procedures deactivated or removed? Examine terminated users accounts Review current access Observe returned physical authentication devices 8.2 In addition to assigning a unique ID, is one or more of Review password procedures the following methods employed to authenticate all Observe authentication processes users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric (a) Are user password parameters configured to 8.2.3 Examine system configuration require passwords/passphrases meet the settings to verify password following? parameters A minimum password length of at least seven characters Contain both numeric and alphabetic characters Alternatively, the passwords/passphrases must have complexity and strength at least equivalent to the parameters specified above.
Requirement 8: Identify and authenticate access to system components PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 8.1.1 Are all users assigned a unique ID before allowing them to access system components or cardholder data? Review password procedures Interview personnel 8.1.3 Is access for any terminated users immediately deactivated or removed? Review password procedures Examine terminated users accounts Review current access Observe returned physical authentication devices 8.2 In addition to assigning a unique ID, is one or more of the following methods employed to authenticate all users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric Review password procedures Observe authentication processes 8.2.3 (a) Are user password parameters configured to require passwords/passphrases meet the following? A minimum password length of at least seven characters Contain both numeric and alphabetic characters Alternatively, the passwords/passphrases must have complexity and strength at least equivalent to the parameters specified above. Examine system configuration settings to verify password parameters
SAQ_C_VT.docx