FAQ #1426 Diff

Is "two-step" authentication the same as "two-factor" or "multi-factor" authentication?

Earlier Version
2016-06-17T00:00:00+00:00

Later Version
2019-05-16T19:37:42+00:00

Removed

Added

~~The idea of "two~~?Two-step" or "multi-step" authentication ~~(e.g. the~~is not the same as "two-factor" or "multi-factor". "Two-step" or "multi-step" authentication involves the subsequent presentation of ~~a secondary~~one or more authentication ~~step~~steps after the first authentication step is successfully performed) does not meet the Council's definition of "multi-factor" authentication, unless both of the following conditions are met:

The whole authentication process requires at least two of the three authentication methods described in PCI DSS Requirement 8.2

a. Something you know, such as a password or passphrase

b. Something you have, such as a token device or smartcard

c. Something you are, such as a biometric

All of the authentication mechanisms used must be independent of one another, meaning access to a secondary authentication mechanism cannot be dependent on the first (for example, relying on username/password authentication for both user authentication as well as governing access to an email account where a secondary factor is sent). This approach is not the same as "multi-factor" authentication, as even though the overall process may rely on multiple authentication methods, each step relies on a single authentication factor.

Refer to the Information Supplement: Multi-Factor Authentication Guidance, available under Guidance Documents in the PCI SSC Document Library, for further guidance.

Disclaimer: This FAQ has been processed for display on this website and may contain errors. Please check the original FAQ on the PCI SSC website for the authoritative version.