FAQ #1067 Diff
Can you provide clarification on the user passwords referenced in PCI DSS 8.5?
Earlier Version
Later Version
Removed
Added
PCI DSS requirement 8.5 requires all user passwords be securely managed. These requirements apply to all non-consumer users (not the cardholder) and administrators, not to credentials supplied by applications or systems. If the passwords are not used by individuals to log on to systems or accounts, and appropriate controls exist to mitigate the risk to passwords, all the requirements in 8.5 may not apply. However, it is an information security best practice to securely manage passwords used by applications and systems, which typically have administrative rightsRequirement 8 addresses secure authentication requirements and requires that all passwords and other authentication credentials be securely managed. These requirements apply to all non-consumer users and administrators. The term "non-consumer user" refers to all individuals, excluding cardholders, who access system components, including employees, administrators, and third parties.
Disclaimer: This FAQ has been processed for display on this website and may contain errors. Please check the original FAQ on the PCI SSC website for the authoritative version.