PCI Requirement 8.1 – Define and Implement Policies and Procedures to Ensure Proper User Management
PCI v4.0 - 8.1.1: Have Requirement 8 Policies and Procedures In Place
PCI Requirement 8.1.2 – Control Addition, Deletion, and Modification of User IDs, Credentials
PCI Requirement 8.1.3 – Immediately Revoke Access for Terminated Users
PCI Requirement 8.1.7 – Set Lockout Duration to a Minimum of 30 Minutes
PCI Requirement 8.1.8 – Require Re-Authentication After 15 Minutes of Inactivity
PCI Requirement 8: Identify and Authenticate Access to System Components
PCI Requirement 8.1.6 – Limit Repeated Access Attempts by Locking Out User ID After Six Attempts
PCI Requirement 8.1.4 – Remove/Disable Inactive User Accounts Within 90 Days
PCI Requirement 8.1.5 – Manage IDs Used by 3rd Parties to Access, Support, or Maintain System Comps
PCI v4.0 - 8.1.2: Have Requirement 8 Roles and Responsibilities In Place
PCI Requirement 8.6 – Authentication Mechanisms Must Not Be Shared Among Multiple Accounts
PCI Requirement 9.8.1 – Shred Hard-Copy Materials so CHD Cannot be Reconstructed
PCI Requirement 8.4 – Document and Communicate Authentication Policies and Procedures to All Users
PCI Requirement 8.5 – Do Not Use Group, Shared, or Generic IDs, or Passwords
PCI Requirement 2.1 - Always Change Vendor-Supplied Defaults
PCI Requirement 3.4.1 Logical Access Management
PCI Requirement 11.1 – Implement Processes to Test for the Presence of Wireless Access Points
PCI Requirement 9.6 – Maintain Control Over the Internal/External Distribution of Any Kind of Media
PCI Requirement 8.5.1 – Remote Access to Customer Premises Must Use Unique Authentication
