8.1 Identification and authentication processes and roles
Requirement 8.1 asks for current policies and procedures for identifying users and authenticating access, and documented roles for identity and authentication management.
Requirement 8 Identify users and authenticate access
Requirement 8 covers user identification, authentication strength, multi-factor authentication and system account management. Each page covers one second-level requirement.
8.2 User identification and account lifecycle
Requirement 8.2 manages user IDs across the account lifecycle: unique IDs, tightly controlled shared accounts, approved changes, immediate revocation on termination, disabling inactive accounts within 90 days, and 15-minute session timeouts.
8.3 Strong authentication
Requirement 8.3 sets authentication strength: at least one factor per user, factors encrypted in transit and storage, lockout after 10 attempts, 12-character passwords, history of four, and 90-day changes where passwords are the only factor.
8.4 Multi-factor authentication for CDE access
Requirement 8.4 requires multi-factor authentication for administrators' non-console access into the CDE, for all access into the CDE, and for all remote network access from outside the entity's network that could reach the CDE.
8.5 MFA system configuration
Requirement 8.5 makes MFA systems resistant to misuse: no replay, no bypass without time-limited management approval, at least two different factor types, and all factors verified before access is granted.
8.6 Application and system accounts
Requirement 8.6 controls application and system accounts: interactive login only by exception, no hard-coded passwords in scripts, configuration files or source code, and password changes and complexity set through a targeted risk analysis.
