In the answer to my question: Two factor authentication for web application under PCI DSS gowenfawr stated:
I have seen other methods used for 2FA than those you mention; IP whitelisting and adaptive authentication specifically. If you can convince your auditor it qualifies, you're all set.
I am wondering if we can use IP whitelisting for access to our servers as the second method of authentication. Requirement 8.6 of PCI DSS states:
8.6 Where other authentication mechanisms are used (for example, physical or logical security tokens, smart cards, certificates, etc.), use of these mechanisms must be assigned as follows:
- Authentication mechanisms must be assigned to an individual account and not shared among multiple accounts.
Would IP whitelisting be allowed as the 2FA method in this situation as sysadmin users may share IPs when connecting to our CDE and other in scope servers (i.e. the public IP address of our office)?