Password and Access Control Policy Draft Quiz

Password and Access Control Policy

• The document is a draft version 0.1 of the Password and Access Control Policy.
• The policy is created to meet PCI DSS requirements 7.1 & 7.2 and 8.5.
• It applies to all systems and assets owned, managed, or operated by the organization.
• The roles and responsibilities outlined include HR Role/Line Manager, Information Security Manager, and Systems Administrators.
• User Authentication is based on the principle of least privilege and need-to-know basis.
• Secure mechanisms for authentication are required for Operating System, Web, Voice, Email, Fax, White Mail, Remote Access, and Network Device.
• Passwords must not be shared, and unique IDs are assigned to all users.
• Access Control Configurations specify password requirements, including length, character types, reuse, history, lockout, and duration.
• Two-factor authentication is required for remote access to the cardholder network.
• Vendors' remote access accounts should be monitored and changed periodically.
• Violation of the policy may lead to disciplinary action, including termination of employment.
• Deviation from the policy requires a valid business case and approval by the Security Management Team and/or Legal Counsel.