User Identification

PCIComplianceHubLast updated

The process of uniquely identifying a user attempting to access a network or system, typically through the use of a username, email address, or other identifier. User identification is a critical component of access control and PCI DSS compliance.

Applies to. Requirement 8 asks that every user is assigned a unique ID before being allowed access to system components or cardholder data, so that each action can be traced to one person. 10.2.2 then requires audit logs to record the user identification for each auditable event, alongside the event type, date and time, success or failure, where the event came from and the data, component or resource it touched.
Limits. 10.2.2 asks the log to capture the user identification for each event; how the identifier is issued and kept unique sits in Requirement 8, not in Requirement 10.
In PCI DSS v4.0.1. 10.2.2
Related. Identification, Unique Identifier (UID), Authentication, Audit Log / Audit Trail, Account
Sources. PCI DSS v4.0.1 (June 2024)