Are vendor remote access accounts monitored Interview personnel when in use? Observe processes 8.1.6 (a) Are repeated access attempts limited by locking out Review password procedures the user ID no more than six attempts? Examine system configuration settings 8.1.7 Once a user account is locked out, is the lockout Review password procedures duration set to a minimum of 30 minutes or an Examine system configuration settings administrator enables the user ID? 8.2 In addition to assigning a unique ID, is one or more of Review password procedures the following methods employed to authenticate all Observe authentication processes users? Something you know, such as a password or passphrase Something you have, such as a device or smart card Something you are, such as a biometric 8.2.1 (a) Is strong cryptography used to render all Review password procedures authentication credentials (such as Review vendor documentation passwords/phrases) unreadable during Examine system configuration settings transmission and storage on all system Observe password files components? Observe data transmissions Are user password parameters configured to 8.2.3 Examine system configuration settings require passwords/passphrases meet the to verify password parameters following? A minimum password length of at least seven characters Contain both numeric and alphabetic characters Alternatively, the passwords/phrases must have complexity and strength at least equivalent to the parameters specified above.
Are vendor remote access accounts monitored when in use? Interview personnel Observe processes 8.1.6 (a) Are repeated access attempts limited by locking out the user ID no more than six attempts? Review password procedures Examine system configuration settings 8.1.7 Once a user account is locked out, is the lockout duration set to a minimum of 30 minutes or an administrator enables the user ID? Review password procedures Examine system configuration settings 8.2 In addition to assigning a unique ID, is one or more of the following methods employed to authenticate all users? Something you know, such as a password or passphrase Something you have, such as a device or smart card Something you are, such as a biometric Review password procedures Observe authentication processes 8.2.1 (a) Is strong cryptography used to render all authentication credentials (such as passwords/phrases) unreadable during transmission and storage on all system components? Review password procedures Review vendor documentation Examine system configuration settings Observe password files Observe data transmissions 8.2.3 Are user password parameters configured to require passwords/passphrases meet the following? A minimum password length of at least seven characters Contain both numeric and alphabetic characters Alternatively, the passwords/phrases must have complexity and strength at least equivalent to the parameters specified above. Examine system configuration settings to verify password parameters
SAQ_A-EP_v3.docx