8.5 MFA systems are configured to prevent misuse
How to meet it
Configure MFA to resist replay and bypass.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 8.5, in plain English.
8.5.1MFA systems resist replay, cannot be bypassed except by approved exception, use at least two factor types, and require all factors to succeed.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Incident response policyUse for ISO 27001 A.5.24 to A.5.28, SOC 2 incident response, PCI DSS 12.10, and security event handling.Password and authentication policyUse for ISO 27001 A.5.17, A.8.5, SOC 2 Security, and PCI DSS requirement 8 authentication controls.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.
Open the control-to-policy map← 8.4 MFA is implemented to secure access into the CDE8.6 Application and system accounts are managed →
Back to Requirement 8, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.