8.2.3 Service provider unique factors per customer

Service providers only (an additional requirement). A service provider with remote access to customer premises must use distinct authentication factors for each customer premises. The guidance explains the risk (one compromised shared factor could expose many customers) and notes that technologies giving a unique credential per connection, such as single-use passwords, could also meet the intent. Applicability: applies only when the assessed entity is a service provider; it does not cover a provider reaching its own shared services environments that host multiple customer environments. If provider staff use shared factors for remote access to customer premises, those factors must differ for each customer and be handled under Requirement 8.2.2. Objective under the customized approach: a service provider credential used at one customer is unusable at every other customer.

Source: PCI DSS v4.0.1, 8.2.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.