1

I have a question regarding this requirement, does even the non-CHD system need to use 2FA?

Ex: When accessing CHD server it asks for 2FA, but do we need the system that accessing from to have 2FA as well?

Improve this question
3
  • The PCI document appears not to care about the system but the environment.
    – schroeder ♦
    Commented Aug 29, 2017 at 8:06
  • Does that means the environment that non CHD should have the 2FA. Note that the environment that non CHD access the environment that have CHD.
    – Petr
    Commented Aug 29, 2017 at 8:35
  • 1
    you are asking a 'scope' question - once you identify the scope, then 8.3.1 applies to all systems in scope, even if they do not have card holder data
    – schroeder ♦
    Commented Aug 29, 2017 at 10:59

1 Answer 1

Reset to default
1

The first problem I seem to encounter revolves around the difference between systems/devices that process/store/transmit cardholder data (aka Category 1 systems/devices) versus those systems/devices that are connected to those Category 1 systems/devices (aka Category 2 systems/devices). The guidance here is that if a Category 2 system has the ability to effect the security of a Category 1 system (i.e., the Category 2 system/device has inbound access to the CDE system(s)/device(s)), then administrators should also use MFA to access those Category 2 systems/devices.

Curled from https://pciguru.wordpress.com/2017/01/07/getting-ready-for-8-3-1/Chris

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .