PCI DSS Requirement 8: Authentication, MFA (8.4.2), and 12-Character Passwords (8.3.6)

Requirement 8 Structure

Deep Dives

• 8.2.1 - Unique ID before access to system components or cardholder data.
• 8.2.2 - Shared/generic accounts only by exception, time-limited, justified, approved, attributable to an individual.
• 8.2.4-8.2.8 - Authorized add/change/delete of IDs and factors; immediate revoke on termination; disable inactive accounts within 90 days; third-party remote access enabled only when needed and monitored; re-authenticate after more than 15 minutes idle.
• 8.3.1 - Authenticate with something you know, have, or are.
• 8.3.2 - Strong cryptography renders authentication factors unreadable in transmission and storage.
• 8.3.4 - Lock out after not more than 10 invalid attempts; lockout at least 30 minutes or until identity confirmed.
• 8.3.6 - Password/passphrase minimum 12 characters (or eight if unsupported) with numeric and alphabetic characters when used as an authentication factor for 8.3.1. Mandatory since 31 March 2025 (until then v3.2.1 seven-character minimum applied).
• 8.3.7 / 8.3.9 - Cannot reuse last four passwords; if password is the only factor (outside MFA scope), change at least every 90 days or use dynamic risk-based access.
• 8.4.1 - MFA for all non-console access into the CDE for personnel with administrative access.
• 8.4.2 - MFA for all access into the CDE (excludes automated application/system accounts and single-PAN POS cashier IDs). Mandatory since 31 March 2025. v4.0.1 Applicability Note: does not apply to accounts authenticated only with phishing-resistant factors.
• 8.4.3 - MFA for all remote network access from outside the entity that could access or impact the CDE (users, administrators, third parties/vendors). MFA for 8.4.2 and 8.4.3 are separate - satisfying one does not satisfy the other.
• 8.5 / 8.5.1 - MFA systems configured to prevent misuse (evolving control set from v4.0 Summary of Changes).

How CyberSilo Helps

• Compliance Standards Automation - MFA and password-policy evidence mapping
• ThreatHawk SIEM - correlate authentication, lockout, and privileged access events (full Requirement 10 guide coming in a later batch)

Frequently Asked Questions

Is MFA Requirement 8.3.2?

No. 8.3.2 requires strong cryptography to protect authentication factors in transit and storage. MFA into the CDE is 8.4.1-8.4.3 - especially 8.4.2 for all access into the CDE.

What is the password length rule under 8.3.6?

If passwords/passphrases are used as an authentication factor for 8.3.1, minimum length is 12 characters (or eight if the system cannot support 12), and they must contain numeric and alphabetic characters. Mandatory since 31 March 2025.

Does phishing-resistant MFA change 8.4.2?

PCI DSS v4.0.1 added an Applicability Note: MFA for all (non-administrative) access into the CDE under 8.4.2 does not apply to user accounts authenticated only with phishing-resistant authentication factors. Confirm scope with your QSA.

Related PCI Resources

PCI DSS hub · PCI DSS v4.0.1: What Changed · USA v4.0.1 services