8.4 MFA is implemented to secure access into the CDE
How to meet it
Require MFA for all access into the CDE and all remote/admin access.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 8.4, in plain English.
8.4.1MFA is required for all non-console administrative access into the CDE.
8.4.2MFA is required for all non-console access into the CDE.
8.4.3MFA is required for all remote access originating from outside the network that could reach the CDE.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Network security policyUse for ISO 27001 A.8.20, A.8.21, A.8.22, A.8.23, SOC 2 Security, and PCI DSS requirements 1 and 4.Password and authentication policyUse for ISO 27001 A.5.17, A.8.5, SOC 2 Security, and PCI DSS requirement 8 authentication controls.Physical and environmental security policyUse for ISO 27001 A.7.1 to A.7.14, SOC 2 Security, and PCI DSS requirement 9 physical access controls.
Open the control-to-policy map← 8.3 Strong authentication is established and managed8.5 MFA systems are configured to prevent misuse →
Back to Requirement 8, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.