8.2.1 All users are assigned a unique ID before access to system components or cardholder data is allowed
All users are assigned a unique ID before access to system components or cardholder data is allowed.
5
artefacts
2
held by a system
1
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Audit logs demonstrating actions can be traced back to an individual user · SIEM / log platform
- Provisioning records showing ID assignment precedes access being granted · Identity provider / directory
periodic reviewEvidence produced at each review
- Evidence that every user is assigned a unique ID before access to system components or cardholder data is allowed · Document repository
governing documentDocuments that govern the control
- User account lists from in scope components showing no shared or generic IDs outside approved exceptions · Policy repository / GRC workspace
- Reconciliation of accounts against the current personnel list to identify orphans · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Unique IDs at the application while the database, operating system or appliance is accessed through a shared administrative account
- Contractors and third party support using a shared vendor account, so their actions are unattributable
- Service accounts used interactively by named people, breaking attribution
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.1.2 Roles and responsibilities for performing activities in Requirement 8 are documented, assigned, and understood · 8.2.2 Group, shared, or generic IDs, or other shared authentication credentials are only used when necessary on an exception basis, and are managed as follows: • ID use is prevented unless needed for an exceptional