I have a question regarding this requirement, does even the non-CHD system need to use 2FA?

Ex: When accessing CHD server it asks for 2FA, but do we need the system that accessing from to have 2FA as well?

  • The PCI document appears not to care about the system but the environment.
    – schroeder
    Aug 29, 2017 at 8:06
  • Does that means the environment that non CHD should have the 2FA. Note that the environment that non CHD access the environment that have CHD.
    – Petr
    Aug 29, 2017 at 8:35
  • 1
    you are asking a 'scope' question - once you identify the scope, then 8.3.1 applies to all systems in scope, even if they do not have card holder data
    – schroeder
    Aug 29, 2017 at 10:59

1 Answer 1


The first problem I seem to encounter revolves around the difference between systems/devices that process/store/transmit cardholder data (aka Category 1 systems/devices) versus those systems/devices that are connected to those Category 1 systems/devices (aka Category 2 systems/devices). The guidance here is that if a Category 2 system has the ability to effect the security of a Category 1 system (i.e., the Category 2 system/device has inbound access to the CDE system(s)/device(s)), then administrators should also use MFA to access those Category 2 systems/devices.

Curled from https://pciguru.wordpress.com/2017/01/07/getting-ready-for-8-3-1/Chris

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.