8.4.3 MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE
MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE.
5
artefacts
0
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the requirement covers all remote access that could access or impact the cardholder data environment, including third party and vendor access · Identity provider / directory
- Records of vendor remote access sessions showing multi-factor applied · Identity provider / directory
governing documentDocuments that govern the control
- Network and system configurations for remote access servers and systems showing multi-factor is required for remote access originating outside the entity's network · Policy repository / GRC workspace
- Observation of users and administrators connecting remotely, showing multi-factor demanded · Policy repository / GRC workspace
- Inventory of remote access mechanisms in use, reconciled against those protected · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Employee remote access protected while vendor and support remote access tools are exempt
- Cloud management consoles reachable from the internet treated as not remote access, so multi-factor is not applied
- Alternative remote paths such as legacy dial-in or secondary gateways left outside the requirement
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.4.2 MFA is implemented for all non-console access into the CDE · 8.5.1 MFA systems are implemented as follows: • The MFA system is not susceptible to replay attacks. • MFA systems cannot be bypassed by any users, including administrative users unless specifically documented, and authorized by