Two-Factor Authentication (2FA)
PCIComplianceHubLast updated
Multi-factor authentication using exactly two factors. 2FA is a subset of MFA rather than a separate control, and the same rule applies: the two factors must come from different categories, so a password paired with a security question does not qualify. Older PCI DSS versions framed the requirement as two-factor authentication for remote access; v4.x speaks in terms of multi-factor authentication and extends it to all access into the cardholder data environment, not only remote access. See Multi-factor Authentication (MFA) under M.
Applies to. Requirement 8 requires multi-factor authentication for all non-console access into the CDE (8.4.2, with 8.4.1 naming administrative access) and for remote access originating from outside the entity's network that could access or impact the CDE (8.4.3), and 8.5.1 sets conditions on the MFA system: at least two different types of factor, success of all factors before access is granted, no bypass except by documented, time-limited management exception, and resistance to replay attacks. A 2FA implementation meets these if its two factors are of different types; the standard never asks for a third.
Related. Multi-factor Authentication (MFA), Authentication Factor, Phishing-Resistant Authentication, One-time Password (OTP)
Sources. PCI DSS v4.0.1 (June 2024)