PCI SSCPCI DSSAccess ControlEASYFree question
How often must passwords be changed under PCI DSS?
- A.At least every 90 days
- B.Annually, how often Requirement 12.6.3 requires security awareness training for personnel
- C.Every 6 months
- D.Monthly, the outer limit Requirement 6.3.3 places on applying critical security patches after their release
Why A is correct
PCI DSS requires passwords to be changed at least every 90 days where passwords are the only authentication factor (v4.0 Requirement 8.3.9), limiting the exposure window if credentials are compromised. Under v4.0 this periodic change can be replaced by dynamic security-posture analysis of accounts, and it does not apply where MFA is used.
Know someone studying for PCI DSS? Send them this one.