8.3 Strong authentication is established and managed
How to meet it
Enforce strong authentication factors and protect them in transit and storage.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 8.3, in plain English.
8.3.1All access is authenticated with at least one factor: something you know, have, or are.
8.3.2Strong cryptography makes all authentication factors unreadable in transit and storage.
8.3.3A user identity is confirmed before changing any authentication factor.
8.3.4Failed attempts are limited by locking the ID after at most 10 tries for at least 30 minutes or until identity is confirmed.
8.3.5First-time and reset passwords are unique and must be changed immediately after first use.
8.3.6Passwords are at least 12 characters (or 8 if unsupported) and contain both letters and numbers.
8.3.7A new password cannot match any of the last four used.
8.3.8Authentication policies are documented and shared with all users.
8.3.9When a password is the only factor, it is changed at least every 90 days or access is decided by dynamic posture analysis.
8.3.10Service providers give customers guidance on periodic password changes where a password is the only factor.
8.3.10.1Service providers change the sole-factor password at least every 90 days or use dynamic posture analysis.
8.3.11Tokens, smart cards, or certificates are assigned to individuals and not shared.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Password and authentication policyUse for ISO 27001 A.5.17, A.8.5, SOC 2 Security, and PCI DSS requirement 8 authentication controls.Cryptography and key management policyUse for ISO 27001 A.8.24, secure authentication, encryption, SOC 2 Security, and PCI DSS encryption requirements.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.
Open the control-to-policy map← 8.2 User identification and accounts are managed8.4 MFA is implemented to secure access into the CDE →
Back to Requirement 8, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.