One-time Password (OTP)

Applies to. PCI DSS v4.0.1 names one-time passwords once, in the guidance to 8.5.1, which lists time-based one-time passwords or passcodes among the anti-replay mechanisms an MFA system can use. They come up under Requirement 8, which requires multi-factor authentication for all non-console access into the CDE and for remote access from outside the entity's network: an OTP from a hardware token or authenticator app is the usual possession factor, proving the user holds that device, and it counts only when paired with a factor of a different type. 8.5.1's conditions on the MFA system apply to the OTP mechanism, so it must not be susceptible to replay and access is granted only when all factors have succeeded; the standard does not rule out OTPs sent by SMS or email, though the Council's own definition of phishing-resistant authentication puts them on the weaker side.