8.3.6 Password minimum length 12 and complexity
Where passwords or passphrases are authentication factors for Requirement 8.3.1, they must at minimum: be at least 12 characters long (or at least eight characters if the system cannot support 12); and include both numeric and alphabetic characters. The guidance suggests entities can consider screening against a list of known bad passwords and adding special or mixed-case characters. Applicability: not intended for point-of-sale terminal user accounts that are limited to a single card number per transaction, nor for application or system accounts, which section 8.6 governs. Until 31 March 2025 the minimum was seven characters, which was the rule under PCI DSS v3.2.1. Objective under the customized approach: neither online nor offline brute forcing can confirm a guessed password or passphrase. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.
Source: PCI DSS v4.0.1, 8.3.6. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.
Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Directory password policy showing minimum length 12 and alphanumeric requirement · Identity provider / directory
- Application password configuration for systems not using the directory · Identity provider / directory
- Banned password list configuration where used · Identity provider / directory
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- List of systems unable to support 12 characters with evidence of an eight-character minimum · Policy repository / GRC workspace
First move
Common gaps auditors find
- Directory still configured with an eight-character minimum on systems that support 12
- Standalone applications enforce no composition rules
- Fine-grained policies for admin groups weaker than the default policy
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.3.5 Initial and reset passwords unique and changed · 8.3.7 No reuse of last four passwords