Authentication Factor
PCIComplianceHubLast updated
The thing that proves an account is being used by who it belongs to: something you know (a password or passphrase), something you have (a token device, smart card or registered phone), or something you are (a biometric). Together with the account identifier, factors make up an authentication credential.
Applies to. Every access to an in-scope system component: 8.3.1 requires at least one factor for every user and administrator, and 8.4 requires two or more of different types for administrative access into the CDE and for all remote access.
Example. A password and a one-time code from an authenticator app are two factors of different types (know and have). A password and a security question are two of the same type, which is not multi-factor authentication.
Limits. Each factor type has its own controls: passwords and passphrases in 8.3.6 to 8.3.10, and the MFA system itself in 8.5.1, which requires that it resist replay, cannot be bypassed, uses factors of at least two types, and grants access only when all factors succeed. A factor that can be reset from knowledge of the account alone protects little, which is why 8.3.5 governs how first-time and reset factors are issued.