PCI 8:

Requirement 8: Assign a unique ID to each person with computer access.

• This ensures that actions taken on critical data and systems are performed by, and can be traced to, known and authorized users.

---

PCI-8.1 Identify all users with a unique username before allowing them to access system components or cardholder data.

---

PCI-8.2 Employ at least one of the methods below, in addition to unique identification, to authenticate all users:

• Password Token devices (e.g., SecureID, certificates, or public key).
• Biometrics.

---

PCI-8.4 Encrypt all passwords during transmission and storage, on all system components.

---

PCI-8.5 Ensure proper user authentication and password management for non-consumer users and administrators, on all system components:

PCI-8.5.1 Control the addition, deletion, and modification of user IDs, credentials, and other identifier objects.

PCI-8.5.2 Verify user identity before performing password resets.

PCI-8.5.3 Set first-time passwords to a unique value per user and change immediately after first use.

PCI-8.5.4 Immediately revoke accesses of terminated users.

PCI-8.5.5 Remove inactive user accounts at least every 90 days.

PCI-8.5.6 Enable accounts used by vendors for remote maintenance only during the time needed.

PCI-8.5.7 Distribute password procedures and policies to all users who have access to cardholder information.

PCI-8.5.8 Do not use group, shared, or generic accounts/passwords.

PCI-8.5.9 Change user passwords at least every 90 days.

PCI-8.5.10 Require a minimum password length of at least seven characters.

PCI-8.5.11 Use passwords containing both numeric and alphabetic characters.

PCI-8.5.12 Do not allow an individual to submit a new password that is the same as any of the last four passwords he or she has used.

PCI-8.5.13 Limit repeated access attempts by locking out the user ID after not more than six attempts.

PCI-8.5.14 Set the lockout duration to thirty minutes or until administrator enables the user ID.

PCI-8.5.15 If a session has been idle for more than 15 minutes, require the user to re-enter the password to re-activate the terminal.

PCI-8.5.16 Authenticate all access to any database containing cardholder information. This includes access by applications, administrators, and all other users.

---

--Mdpeters 12:57, 7 July 2006 (EDT)