8.1.2 Requirement 8 roles and responsibilities assigned
Responsibilities for carrying out Requirement 8 activities, such as issuing IDs, managing authentication factors, operating MFA and controlling application and system accounts, must be documented, assigned and understood by the people concerned. The guidance notes they may be recorded in policies, procedures or separate documents such as a RACI matrix, and that entities can consider having staff acknowledge them. Customized approach objective: day-to-day duties for every Requirement 8 activity are allocated, and personnel are accountable for the successful and continuous operation of these controls.
Source: PCI DSS v4.0.1, 8.1.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.
Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Role acknowledgement records · Identity provider / directory
- Interview records with MFA platform and directory administrators · Identity provider / directory
governing documentDocuments that govern the control
- RACI matrix for identity lifecycle, authentication and MFA administration · Policy repository / GRC workspace
- Job descriptions for identity administrators and help desk staff covering authentication duties · Policy repository / GRC workspace
First move
Common gaps auditors find
- Ownership of service account password management is undefined
- Help desk performs resets without assigned accountability for identity checks
- RACI still names staff who left the organization
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.1.1 Requirement 8 policies and procedures maintained · 8.2.1 Unique ID assigned to every user