{"id":585,"date":"2020-04-19T18:20:41","date_gmt":"2020-04-19T18:20:41","guid":{"rendered":"http:\/\/www.pcidssguide.com\/?p=585"},"modified":"2023-10-09T13:45:04","modified_gmt":"2023-10-09T13:45:04","slug":"what-are-the-pci-dss-password-requirements","status":"publish","type":"post","link":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/","title":{"rendered":"What Are the PCI DSS Password Requirements?"},"content":{"rendered":"\n\n\n\n\n<p>Passwords are essential for computer protection and payment data. However, they need to be updated frequently to be robust and efficient. Manufacturer defaults and weak passwords are a common source of security breaches.<\/p>\n\n\n\n<p>PCI compliance requirements for passwords required by the PCI Data Security Standards (PCI DSS) are explicitly set out in <a href=\"https:\/\/pcidssguide.com\/pci-dss-requirement-8\/\">PCI DSS Standards Requirement 8<\/a>.<\/p>\n\n\n\n<p>To protect against password-related threats, PCI DSS requires passwords to comply with the following conditions:<\/p>\n\n\n\n<ul>\n<li>Requires a <strong>minimum of seven characters<\/strong> or more in length.<\/li>\n\n\n\n<li>Must contain <strong>numeric characters as well as alphabetic characters<\/strong>.<\/li>\n\n\n\n<li>Users are expected to <strong>change their passwords at least every 90 days<\/strong>.<\/li>\n\n\n\n<li>The new passwords must be modified so that <strong>they are not the same as the<\/strong> <strong>four previously used passwords<\/strong>.<\/li>\n\n\n\n<li>New user first-time passwords and current user reset passwords must be <strong>set to a unique value for each user and updated after first use<\/strong>.<\/li>\n\n\n\n<li>After up to <strong>six invalid access attempts<\/strong>, user accounts should be <strong>temporarily locked<\/strong>.<\/li>\n\n\n\n<li>When a user account is locked, it must <strong>stay locked for a period of 30 minutes<\/strong> or until a system administrator resets the account.<\/li>\n\n\n\n<li>System\/session idle timeout settings must be set to <strong>15 minutes<\/strong> or less.<\/li>\n\n\n\n<li>Passwords should be secured with <strong>strong cryptography<\/strong> <strong>during transmission and storage<\/strong>.<\/li>\n\n\n\n<li><strong>Vendor published defaults should not be used<\/strong> for system passwords and other security parameters.<\/li>\n<\/ul>\n\n\n\n<p>Password requirements for PCI DSS compliance are relatively straightforward and easily set with today&#8217;s directory service, such as Active Directory. For other systems that do not use a directory service for authentication, it is essential to create passwords with the above basic parameters to help protect the cardholder data environment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Password Policy Details in PCI DSS Requirement 2<\/strong><\/h2>\n\n\n\n<p>The first specific guidelines on passwords in PCI DSS are about removing passwords, especially third-party automatically generated default passwords for users.<\/p>\n\n\n\n<p>Most of the time, hardware and software are shipped with default user accounts enabled. These accounts use a common username and password such as &#8220;USER&#8221; and &#8220;PASSWORD&#8221; to facilitate easy access.<\/p>\n\n\n\n<p>While these accounts are intended to be reconfigured by users as soon as possible, there are several reasons why a user might fail to do so immediately, making them a prime target for hackers and other cybercriminals.<\/p>\n\n\n\n<p>Therefore, all automatically generated passwords and accounts must be removed before installing or integrating a device or system into the more comprehensive network. Changing default accounts and passwords is the main focus of the PCI second requirement. Subsections within parameters determine where and how this rule is applied for various account types and authentication.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Password Policy Details in PCI DSS Requirement 8<\/strong><\/h2>\n\n\n\n<p>Where PCI DSS sets the full-fledged password policy is in PCI DSS requirement 8.<\/p>\n\n\n\n<p>PCI requirement eight specifies parameters for the planning and execution of the entire authentication system, not just passwords. This includes everything the user encounters, from IDs and passwords to other login elements like crashes and error messages. It also includes areas outside of user visibility, such as the storage and internal processing of accounts.<\/p>\n\n\n\n<p>The most critical parts of PCI DSS requirement eight can be summarized as follows:<\/p>\n\n\n\n<ul>\n<li>Assign a unique ID to all users.<\/li>\n\n\n\n<li>Avoid reuse of individual identities, even after they have expired.<\/li>\n\n\n\n<li>Strongly encrypt all user credentials in both transmission and storage.<\/li>\n\n\n\n<li>All IDs and passwords must be unreadable.<\/li>\n\n\n\n<li>Strictly control login attempts, crashes, and error messages.<\/li>\n\n\n\n<li>Limit the number of password attempts.<\/li>\n\n\n\n<li>Disable login after a certain number.<\/li>\n\n\n\n<li>Use vague or generalized error messages.<\/li>\n\n\n\n<li>Exercise control over the creation and deletion of accounts.<\/li>\n\n\n\n<li>Monitor unused accounts and delete them after long absences.<\/li>\n\n\n\n<li>Educate all account holders on the aspects of account security.<\/li>\n\n\n\n<li>Enable automatic generation of strong passwords.<\/li>\n\n\n\n<li>Provide resources for password strength analysis and best practices.<\/li>\n\n\n\n<li>The length of a password must be at least seven characters.<\/li>\n\n\n\n<li>Both letters and numbers must be used in the password.<\/li>\n\n\n\n<li>A regular password reset is required every 90 days.<\/li>\n\n\n\n<li>Do not allow the use of previous passwords and combinations.<\/li>\n\n\n\n<li>Restrict specific sensitive access points with MFA.<\/li>\n\n\n\n<li>Use MFA for remote access to all systems.<\/li>\n\n\n\n<li>Use MFA for third-party access.<\/li>\n<\/ul>\n\n\n\n<p>These sub-requirements, when taken together, form the heart of the PCI DSS password policy, which dictates how passwords should be used to ensure PCI compliance. These standards provide a consistent minimum level of cybersecurity and password policy across all PCI-compliant companies.<\/p>\n\n\n\n<p>As long as the controls satisfy the PCI password policy, PCI DSS permits it to incorporate controls other than those established in the PCI standard, such as those defined by the <a href=\"https:\/\/pages.nist.gov\/800-63-3\/\">National Institute of Standards and Technology Special Publication (NIST) 800-63<\/a>. <\/p>\n\n\n\n<p>For the use of memorized secrets, such as PINs and passwords to validate digital identity, NIST SP 800-63 provides requirements, recommendations, and guidance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How to Set Strong Passwords?<\/strong><\/h2>\n\n\n\n<p>When a password is not complex enough, it is much easier for an attacker to access a system. An attacker can perform a brute force attack by making multiple password attempts through an automated tool that will enter thousands of passwords in seconds until someone runs.<\/p>\n\n\n\n<p>The PCI DSS standard requires passwords to contain at least seven characters in uppercase and lowercase letters. Other instructions suggest including long passwords, numbers, and special characters. Using password cracking software, passwords that fall below specific standards can be easily cracked.<\/p>\n\n\n\n<p>The longer the password and the greater the combination of characters, the harder it would be for an attacker to break the password in operation.<\/p>\n\n\n\n<p>Part of the authentication process involves passwords, but unfortunately, passwords also bring problems. The main problem with passwords is that brute force and dictionary attacks crack them relatively quickly. Programs like John the Ripper and L0phtCrack can quickly crack complex passwords.<\/p>\n\n\n\n<p>Human nature also allows vulnerable passwords. Employees prefer to choose passwords that they can recall quickly and passwords that a data thief can easily guess through social engineering. Most staff still prefer to type in passwords and even share them with others for convenience.<\/p>\n\n\n\n<p>Unfortunately, many companies don&#8217;t know how easily cybercriminals can crack a password. Especially if it is a widely used password, attackers get results much faster. As a result, you can find lousy password apps below:<\/p>\n\n\n\n<ul>\n<li><strong>Sharing credentials:<\/strong> Employees often share accounts and credentials to save time. However, it makes it easier for social engineers to access sensitive data quickly.<\/li>\n\n\n\n<li><strong>Not updating passwords regularly:<\/strong> It is only a matter of time before many hackers crack a password. Hence, businesses that have used the same passwords for their accounts since the company was founded are vulnerable.<\/li>\n\n\n\n<li><strong>Choosing predictable words like &#8220;Password&#8221; or &#8220;Admin&#8221;:<\/strong> These types of passwords are trendy and are probably the first words hackers guessed when trying to access remotely.<\/li>\n<\/ul>\n\n\n\n<p>So how can you be sure you have secure passwords? Here are a few essential apps you can implement.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Set unique credentials and change default passwords<\/strong><\/h3>\n\n\n\n<p>Using various passwords for different services is important. That way, you cannot use the same credentials to access information from other services if a service is compromised.<\/p>\n\n\n\n<p>Employees often exchange passwords as they share their username, which means their credentials are no longer private. Shared accounts become even more vulnerable to social engineering attacks. When a group of people shares similar credentials, companies cannot distinguish exactly who is performing a particular action in their systems.<\/p>\n\n\n\n<p>Ensure your employees do not use the same usernames or passwords and do not share them. Most companies create a numeric username that has no relation to the user&#8217;s real name. For example, the administrator&#8217;s username should be replaced with a username that does not specify the administrator.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>It would be best if you also changed all default passwords for devices and apps.<\/strong><\/h3>\n\n\n\n<p>The longer your password is, the better. Longer passwords are more difficult to crack as larger encryption keys are more difficult to crack. PCI DSS recommends that businesses have passwords of at least eight characters, but passwords of 10-15 characters or more are generally recommended.<\/p>\n\n\n\n<p>It would be best if you also made passwords even more complex by using a combination of numbers, symbols, and letters.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Have limited login attempts with lockout rules<\/strong><\/h3>\n\n\n\n<p>PCI DSS requirement 8 requires accounts to be locked out after six consecutive login attempts. Accounts must remain locked for 30 minutes or until the account is reset by a system administrator. The account locking measure helps avoid many types of brute force attacks.<\/p>\n\n\n\n<p>When an attacker has only six chances to guess the correct answer, their attempt is likely to fail. When accounts are locked, attackers will go to an easier target.<\/p>\n\n\n\n<p>Set your employees to try to log into a system multiple times. After several unsuccessful sign-in, let the account lockout whoever is trying to get in. This way, you avoid brute force attacks and attempts by social engineers to guess passwords.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What is a Strong Password?<\/strong><\/h2>\n\n\n\n<p>Attackers use easily guessable passwords because many people still use quickly guessing passwords. A strong password must contain seven or more characters, a mixture of upper and lower case letters, numbers, and symbols (such as! @ # $ &amp; *).<\/p>\n\n\n\n<p>Hackers can use the default, common, or leaked passwords to get into your network. Out-of-the-box computer equipment and applications, including payment terminals, come with default passwords such as &#8220;password&#8221; or &#8220;admin,&#8221; commonly known to criminals.<\/p>\n\n\n\n<p>Businesses must securely change these default passwords to reduce the risk of being compromised, and they should never be shared as each employee must have their login ID and password.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How to Create a Strong Password?<\/strong><\/h2>\n\n\n\n<p>Nowadays, people don&#8217;t stop using their favorite sport as a password. The top ten commonly used passwords list are as follows:<\/p>\n\n\n\n<ul>\n<li>123456<\/li>\n\n\n\n<li>password<\/li>\n\n\n\n<li>12345678<\/li>\n\n\n\n<li>Qwerty<\/li>\n\n\n\n<li>12345<\/li>\n\n\n\n<li>123456789<\/li>\n\n\n\n<li>Football<\/li>\n\n\n\n<li>1234<\/li>\n\n\n\n<li>1234567<\/li>\n\n\n\n<li>Baseball<\/li>\n<\/ul>\n\n\n\n<p>None of these passwords are secure because they are straightforward to guess, too simple, or depend on the keyboards&#8217; models. Hackers are well versed in these lists and often use them as a first step to crack your password. You can change them as soon as possible if any of your passwords are on this list.<\/p>\n\n\n\n<p>The best practice is to create a unique password. Some other standard password rules you can apply are as follows:<\/p>\n\n\n\n<ul>\n<li>Using a mix of letters in upper and lowercase.<\/li>\n\n\n\n<li>Do not use names or other personal information.<\/li>\n\n\n\n<li>Replace individual letters with numbers<\/li>\n\n\n\n<li>Use gibberish, typos, or substitutions.<\/li>\n\n\n\n<li>Do not use repetitive patterns for password change.<\/li>\n\n\n\n<li>For personal and work accounts, don&#8217;t use the same passwords.<\/li>\n<\/ul>\n\n\n\n<p>It should be noted that you cannot wholly trust strong passwords. A password does not protect data completely. It would be best to have a combination of multi-factor authentication, encryption, and other protocols to keep your data safe.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How Can You Upgrade the PCI DSS Password Requirements?<\/strong><\/h2>\n\n\n\n<p>PCI DSS password requirements provide the minimum level of complexity and power expected to be met by any organization using various technologies. PCI SSC also encourages organizations to implement stricter controls or additional security measures to meet security needs as needed.<\/p>\n\n\n\n<p>When users have to generate and remember complex passwords too often, they tend to use repetitive patterns and save them in vulnerable ways that create new vulnerabilities. It is recommended that organizations go beyond the PCI DSS password requirements to ensure an appropriate security level.<\/p>\n\n\n\n<p>PCI DSS allows organizations to implement alternative controls to those defined in the standard, provided that PCI DSS requirements are met. When evaluating alternative methods, it is necessary not to consider individual suggestions alone but to apply all recommendations as a complete collection of controls.<\/p>\n\n\n\n<p>If you are trying to meet your PCI DSS requirements, you must comply with the PCI DSS&#8217;s password requirements. However, you can apply the following additional controls to strengthen your protection:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Use PassPhrases<\/strong><\/h3>\n\n\n\n<p>Many companies are starting to use password phrases instead of passwords to strengthen personal and commercial data protection. Although passwords are strings of about ten letters, numbers, and symbols, passwords are groups of words with spaces between them.<\/p>\n\n\n\n<p>Pass and Take $ 100 &#8211; P@$$andTake$100<\/p>\n\n\n\n<p>Passwords can contain symbols, upper and lower case letters and do not have to be grammatically meaningful. Passwords usually are easier to remember but more difficult to crack than passwords.<\/p>\n\n\n\n<p>Details about passwords and passphrases can be found below:<\/p>\n\n\n\n<ul>\n<li>Passwords contain spaces and words. Passphrases are strings of letters, numbers, and symbols that are approximately ten characters long.<\/li>\n\n\n\n<li>In general, passwords are more extended than passwords.<\/li>\n\n\n\n<li>Passphrase sentences can be made more complex and stable by using symbols, numbers, and upper and lower case letters.<\/li>\n\n\n\n<li>Major operating systems (Windows, Mac, Linux) allow passwords up to 127 characters long.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Use Password Blacklist<\/strong><\/h3>\n\n\n\n<p>User-generated passwords also have limits. You can reduce your exposure by checking user passwords against a compromised password list. You can use the 100,000 most compromised passwords list or use online resources to create your password blacklist.<\/p>\n\n\n\n<p>Suppose you&#8217;re looking for a more comprehensive list without having to compile your password. In that case, you can use a third-party password filtering service that includes billions of stolen passwords and is regularly updated with new leaked passwords.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Monitor User Passwords<\/strong><\/h3>\n\n\n\n<p>If you do not currently have a mechanism for checking compromised passwords, you should scan your database for weak or leaked passwords. It is essential to examine the database and find out which accounts are using weak or blacklisted passwords.<\/p>\n\n\n\n<ul>\n<li>You can also use the following ideas to find weak passwords:<\/li>\n\n\n\n<li>Expired encrypted accounts<\/li>\n\n\n\n<li>Accounts with approaching password expiration dates<\/li>\n\n\n\n<li>Accounts using the same passwords<\/li>\n\n\n\n<li>Accounts that do not require a password<\/li>\n\n\n\n<li>Accounts that do not require a minimum password length<\/li>\n\n\n\n<li>Old\/inactive manager accounts<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Implement Multi-Factor Authentication<\/strong><\/h3>\n\n\n\n<p>System protection should not rely solely on the strength of a single password. Both passwords should not be considered unbreakable. Therefore, the implementation of multi-factor authentication is vital in protecting remote access, which is a requirement under PCI DSS.<\/p>\n\n\n\n<p>It requires at least two of the following three criteria to configure <a href=\"https:\/\/pcidssguide.com\/pci-multi-factor-authentication-checklist\/\">multi-factor authentication<\/a>:<\/p>\n\n\n\n<ul>\n<li>Something only you know (e.g., a username and password, PIN)<\/li>\n\n\n\n<li>Only something you have (e.g., Token, smart card)<\/li>\n\n\n\n<li>Something that you only have (e.g., fingerprint, retinal scan)<\/li>\n<\/ul>\n\n\n\n<p>Examples of adequate remote access multi-factor authentication include:<\/p>\n\n\n\n<ul>\n<li>The remote user must enter their username and password and then enter the one-time password (OTP) sent to their smartphone.<\/li>\n\n\n\n<li>The remote user must enter their username and password and then use a unique dynamic number found in the Secure coin.<\/li>\n<\/ul>\n\n\n\n<p>The authentication mechanisms you use should be independent of each other. This is so that one factor does not require access to another. This is because if one factor is compromised, it doesn&#8217;t affect the other factor&#8217;s integrity or privacy.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Use Open Password Scan Tools<\/strong><\/h3>\n\n\n\n<p>Enforcing password expirations leads to weak passwords because users often change only a few characters in their password and, as a result, do not change the password as a whole. There is a much simpler solution instead of forcing users to change their passwords every 30, 60, or 90.<\/p>\n\n\n\n<p>Don&#8217;t ask users to change their passwords unless they realize they are using leaked passwords. You can now constantly monitor user passwords to check if their passwords have been subject to a data breach or using common passwords. Open password scanning can increase security without inconveniencing your users.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Suggest Longer Passwords Over Complexity<\/strong><\/h3>\n\n\n\n<p>You must meet the length and complexity criteria in the PCI password requirements. However, when password complexity is enforced, users tend to default to behaviors such as capitalizing the first character or adding 1 to the end of the password. Hackers know this and create algorithms to crack these passwords easily.<\/p>\n\n\n\n<p>If the password is too complex, the user can write it down or store it in an unsafe place. Additionally, research has shown that longer passwords without complexity are more robust than shorter passwords with complexity. Longer passwords with complexity will be even stronger.<\/p>\n\n\n\n<p>Many companies now ask users to create easy-to-remember passwords, such as &#8220;the best meal is hamburger because it&#8217;s delicious, filling and delicious for me and everyone else.&#8221; Regarding what password length should be enforced, it should be a minimum of 12 to 15 characters and not a maximum. If you need to apply a maximum, it should be significantly higher than the minimum.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How to Manage Passwords Easily?<\/strong><\/h2>\n\n\n\n<p>The implementation of corporate password management helps small, and large businesses keep their information intact. No matter how many employees you have, you may need help protecting the passwords that run your business.<\/p>\n\n\n\n<p>A password manager allows you to create strong passwords and remember each one for you. However, if you choose this route, you will need to create and remember a secure password.<\/p>\n\n\n\n<p>Trying to remember each password or using an easy-to-read pattern is where the problem begins.<\/p>\n\n\n\n<p>This is where password managers make life more comfortable. The password manager recalls all your passwords for you as long as you can create a powerful master password that is important for you to remember.<\/p>\n\n\n\n<p>There are three platforms that you can use specifically for password management. Each of these is a reliable option:<\/p>\n\n\n\n<ul>\n<li>Dashlane<\/li>\n\n\n\n<li>LastPass<\/li>\n\n\n\n<li>KeePass<\/li>\n<\/ul>\n\n\n\n<p>The important thing is to remember that you need to use random words for a secure password.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Conclusion<\/strong><\/h2>\n\n\n\n<p>Indeed, passwords alone cannot protect your data very well, but you should choose the passwords you use as strong as possible. Many businesses don&#8217;t even use essential password protection shows how insecure their data can be.<\/p>\n\n\n\n<p>Passwords will no longer be needed as technology advances, but computers and applications currently require unique, strong passwords. Companies should always check and change the default passwords developed when setting up their routers \/ POS systems. Many default passwords have been posted on the Internet, making it very easy for hackers to hack your computers.<\/p>\n\n\n\n<p><strong>See Also:<\/strong> <strong><a href=\"https:\/\/blog.pcisecuritystandards.org\/infographic-strong-passwords\">PCI SSC Infographic: Strong Passwords<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Passwords are important for computer protection and payment data. But they need to be robust and updated frequently to be efficient.<\/p>\n","protected":false},"author":1,"featured_media":591,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[46,30],"tags":[104],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>What Are the PCI DSS Password Requirements? - PCI DSS GUIDE<\/title>\n<meta name=\"description\" content=\"PCI compliance requirements for passwords required by the PCI Data Security Standards (PCI DSS) are explicitly set out in PCI DSS Standards Requirement 8.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Are the PCI DSS Password Requirements? - PCI DSS GUIDE\" \/>\n<meta property=\"og:description\" content=\"PCI compliance requirements for passwords required by the PCI Data Security Standards (PCI DSS) are explicitly set out in PCI DSS Standards Requirement 8.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/\" \/>\n<meta property=\"og:site_name\" content=\"PCI DSS GUIDE\" \/>\n<meta property=\"article:published_time\" content=\"2020-04-19T18:20:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-10-09T13:45:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-password-requirements-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1280\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Surkay Baykara\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Surkay Baykara\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/\"},\"author\":{\"name\":\"Surkay Baykara\",\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"headline\":\"What Are the PCI DSS Password Requirements?\",\"datePublished\":\"2020-04-19T18:20:41+00:00\",\"dateModified\":\"2023-10-09T13:45:04+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/\"},\"wordCount\":2931,\"publisher\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"image\":{\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-password-requirements-1.jpg\",\"keywords\":[\"passwords\"],\"articleSection\":[\"Passwords\",\"PCI DSS Requirement 8\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/\",\"url\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/\",\"name\":\"What Are the PCI DSS Password Requirements? - PCI DSS GUIDE\",\"isPartOf\":{\"@id\":\"https:\/\/pcidssguide.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-password-requirements-1.jpg\",\"datePublished\":\"2020-04-19T18:20:41+00:00\",\"dateModified\":\"2023-10-09T13:45:04+00:00\",\"description\":\"PCI compliance requirements for passwords required by the PCI Data Security Standards (PCI DSS) are explicitly set out in PCI DSS Standards Requirement 8.\",\"breadcrumb\":{\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#primaryimage\",\"url\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-password-requirements-1.jpg\",\"contentUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-password-requirements-1.jpg\",\"width\":1920,\"height\":1280,\"caption\":\"PCI DSS Password Requirements\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/pcidssguide.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What Are the PCI DSS Password Requirements?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/pcidssguide.com\/#website\",\"url\":\"https:\/\/pcidssguide.com\/\",\"name\":\"PCI DSS GUIDE\",\"description\":\"PCI Compliance Guide For All Business\",\"publisher\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/pcidssguide.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\",\"name\":\"Surkay Baykara\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g\",\"caption\":\"Surkay Baykara\"},\"logo\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/\"},\"description\":\"A passionate Senior Information Security Consultant working at Cyberwise. Over the past 15+ years my professional career has included several positions beginning as a developer and IT administrator, working my way up to a senior Technical Performance Consultant before joining Biznet back in 2015. I had several different roles at Cyberwise, including Penetration Tester and PCI DSS QSA. In my job as a QSA, I found my passion and worked closely with the Audit and Compliance team. I've been working inside InfoSec for over 15 years, coming from a highly technical background. I have earned several certifications during my professional career including; CEH, CISA, CISSP, and PCI QSA.\",\"sameAs\":[\"https:\/\/www.pcidssguide.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What Are the PCI DSS Password Requirements? - PCI DSS GUIDE","description":"PCI compliance requirements for passwords required by the PCI Data Security Standards (PCI DSS) are explicitly set out in PCI DSS Standards Requirement 8.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/","og_locale":"en_US","og_type":"article","og_title":"What Are the PCI DSS Password Requirements? - PCI DSS GUIDE","og_description":"PCI compliance requirements for passwords required by the PCI Data Security Standards (PCI DSS) are explicitly set out in PCI DSS Standards Requirement 8.","og_url":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/","og_site_name":"PCI DSS GUIDE","article_published_time":"2020-04-19T18:20:41+00:00","article_modified_time":"2023-10-09T13:45:04+00:00","og_image":[{"width":1920,"height":1280,"url":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-password-requirements-1.jpg","type":"image\/jpeg"}],"author":"Surkay Baykara","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Surkay Baykara","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#article","isPartOf":{"@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/"},"author":{"name":"Surkay Baykara","@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"headline":"What Are the PCI DSS Password Requirements?","datePublished":"2020-04-19T18:20:41+00:00","dateModified":"2023-10-09T13:45:04+00:00","mainEntityOfPage":{"@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/"},"wordCount":2931,"publisher":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"image":{"@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#primaryimage"},"thumbnailUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-password-requirements-1.jpg","keywords":["passwords"],"articleSection":["Passwords","PCI DSS Requirement 8"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/","url":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/","name":"What Are the PCI DSS Password Requirements? - PCI DSS GUIDE","isPartOf":{"@id":"https:\/\/pcidssguide.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#primaryimage"},"image":{"@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#primaryimage"},"thumbnailUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-password-requirements-1.jpg","datePublished":"2020-04-19T18:20:41+00:00","dateModified":"2023-10-09T13:45:04+00:00","description":"PCI compliance requirements for passwords required by the PCI Data Security Standards (PCI DSS) are explicitly set out in PCI DSS Standards Requirement 8.","breadcrumb":{"@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#primaryimage","url":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-password-requirements-1.jpg","contentUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-password-requirements-1.jpg","width":1920,"height":1280,"caption":"PCI DSS Password Requirements"},{"@type":"BreadcrumbList","@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-password-requirements\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/pcidssguide.com\/"},{"@type":"ListItem","position":2,"name":"What Are the PCI DSS Password Requirements?"}]},{"@type":"WebSite","@id":"https:\/\/pcidssguide.com\/#website","url":"https:\/\/pcidssguide.com\/","name":"PCI DSS GUIDE","description":"PCI Compliance Guide For All Business","publisher":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/pcidssguide.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741","name":"Surkay Baykara","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g","caption":"Surkay Baykara"},"logo":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/"},"description":"A passionate Senior Information Security Consultant working at Cyberwise. Over the past 15+ years my professional career has included several positions beginning as a developer and IT administrator, working my way up to a senior Technical Performance Consultant before joining Biznet back in 2015. I had several different roles at Cyberwise, including Penetration Tester and PCI DSS QSA. In my job as a QSA, I found my passion and worked closely with the Audit and Compliance team. I've been working inside InfoSec for over 15 years, coming from a highly technical background. I have earned several certifications during my professional career including; CEH, CISA, CISSP, and PCI QSA.","sameAs":["https:\/\/www.pcidssguide.com"]}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/585"}],"collection":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/comments?post=585"}],"version-history":[{"count":2,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/585\/revisions"}],"predecessor-version":[{"id":2238,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/585\/revisions\/2238"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/media\/591"}],"wp:attachment":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/media?parent=585"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/categories?post=585"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/tags?post=585"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}