Authentication requiring evidence from at least two of three separate categories: something the user knows, for example a password; something the user has, for example a token or registered device; and something the user is, for example a biometric. The categories must differ. Two passwords, or a password and a security question, are not multi-factor, because both come from the same category. PCI DSS v4.x requires MFA for all non-console access into the Cardholder Data Environment and for remote access from outside the entity's network that could reach or affect it. Requirement 8.5.1 adds that the MFA system must not be susceptible to replay attacks, must not be bypassable except by a documented, management-approved exception for a limited time, and must succeed on every factor before access is granted.
Applies to. 8.4.2 applies it to all non-console access into the Cardholder Data Environment, whoever the user is, and 8.4.1 names personnel with administrative access specifically. Its applicability note excludes three cases: application and system accounts performing automated functions, user accounts on point-of-sale terminals that can reach only one card number at a time to complete a single transaction, and user accounts authenticated only with phishing-resistant authentication factors. 8.4.3 applies it to remote access that originates outside the entity's network and could access or impact the CDE, and its testing procedure has the assessor watch users, administrators and third parties connecting in. 8.5.1 governs the MFA system itself, and its testing procedures cover both logins to system components in the CDE and remote connections from outside the network, checking that access opens only after every factor succeeds.
Example. A merchant's IT contractor supports the store network from her own office. Her VPN login asks for her password and then a code generated on a hardware token she carries, and the connection fails if either is wrong. Inside the office, a systems administrator opening a remote desktop session to a server in the CDE is challenged the same way, because 8.4.2 treats that as non-console access into the CDE.
Limits. Console access is outside 8.4.2, which is limited to non-console access. Two factors of the same type do not make MFA: 8.5.1 requires two different types, so a password plus a PIN is still one category. Two-factor authentication (2FA) is the two-factor case of MFA, not a competing term. 8.4.2 and 8.4.3 are separate requirements, one for access into the CDE and one for remote access from outside the entity's network, so an entity has to be able to show each is met on its own.