Identify users and authenticate access
Requirement 8 ensures that every individual with access to the Cardholder Data Environment (CDE) is uniquely identified and authenticated. The goal is to ensure accountability by linking every action taken within the environment to a specific person or system entity.
What it means
In practice, this means "shared accounts" are prohibited. You cannot have multiple employees using a single "admin" or "manager" login; each person must have their own credentials so that audit logs can pinpoint exactly who performed a change or accessed data.
The scope extends beyond just human users to include service accounts and system-to-system communications. Authentication must be robust, moving away from simple passwords toward Multi-Factor Authentication (MFA) for all access into the CDE and for all administrative access.
Furthermore, this requirement governs the entire lifecycle of a user's identity—from how they are onboarded and assigned permissions to how their access is revoked immediately upon termination or change in job role.
How to meet it
- Assign a unique User ID to every person with access to the CDE; strictly forbid the use of shared or group accounts.
- Implement Multi-Factor Authentication (MFA) for all personnel accessing the CDE and for all non-console administrative access.
- Enforce strong password requirements or secure authentication methods that meet PCI DSS v4.0 complexity and rotation standards.
- Establish a formal process to revoke access immediately upon an employee's termination or change in role.
- Change all vendor-supplied default passwords on any system, application, or device before deploying it into the CDE.
- Implement automated locking mechanisms that disable accounts after a set number of failed login attempts.
Evidence an auditor asks for
- A current list of all users with access to the CDE and their associated roles/permissions.
- Configuration screenshots proving MFA is enabled and enforced for remote and administrative access.
- The organization's written password policy and identity management procedures.
- Samples of termination tickets compared against system logs to prove accounts were disabled promptly.
- System configuration files or reports showing that default passwords have been changed.
Common pitfalls
- Failing to identify "service accounts" as users, leaving them with static, weak passwords or excessive permissions.
- Overlooking the requirement for MFA on internal access; some organizations mistakenly believe MFA is only required for remote/external access.
- Maintaining a "stale" user list where former employees still have active accounts because HR and IT are not synchronized.
- Using shared credentials for legacy systems that do not natively support unique IDs without implementing a compensating control.