8.6 Application and system accounts are managed
How to meet it
Control service-account credentials, rotate them, and avoid interactive use.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 8.6, in plain English.
8.6.1System/application accounts allowing interactive login are managed so interactive use is by exception, justified, approved, and traceable.
8.6.2Passwords for application/system accounts allowing interactive login are not hard-coded in scripts, config files, or source code.
8.6.3Passwords for application/system accounts are changed periodically and on suspected compromise, and are sufficiently complex.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Secure development policyUse for ISO 27001 A.8.25 to A.8.32, source code controls, change management, and SOC 2 change controls.Password and authentication policyUse for ISO 27001 A.5.17, A.8.5, SOC 2 Security, and PCI DSS requirement 8 authentication controls.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.
Open the control-to-policy mapBack to Requirement 8, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.