8.6.3 System account passwords protected against misuse
Passwords or passphrases used by system and application accounts must be protected against misuse so that: they are changed periodically, at the frequency set by the entity's own targeted risk analysis performed per Requirement 12.3.1, and upon suspected or confirmed compromise; and they are built with enough complexity for how often the entity changes them. The guidance lists risk factors to weigh (how securely they are stored, such as in a vault; staff turnover; how many people can reach the factor; whether interactive login is possible; and whether dynamic posture analysis is used) and advises that complexity be stricter where changes are infrequent. Objective under the customized approach: passwords of application and system accounts cannot stay usable indefinitely and are built so that guessing and brute-force attacks fail. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.
Source: PCI DSS v4.0.1, 8.6.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.
Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Vault rotation logs or change records demonstrating rotation at the defined frequency · Identity provider / directory
- Configuration showing complexity settings for service account credentials · Identity provider / directory
periodic reviewEvidence produced at each review
- Targeted risk analysis per 12.3.1 setting change frequency and complexity for service account passwords · Identity provider / directory
- Records of rotation after suspected or confirmed compromise · Identity provider / directory
governing documentDocuments that govern the control
none for this control
First move
Common gaps auditors find
- Service account passwords unchanged for years because rotation could break applications
- Risk analysis sets a long rotation period without raising complexity
- No process to rotate credentials when an administrator with knowledge leaves
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.6.2 No hard-coded passwords for interactive system accounts · 9.1.1 Requirement 9 policies and procedures maintained