PCI-DSS v4.0 Raised the Password Bar. Here's What You Missed.
PCI-DSS v4.0 brought significant changes to password requirements. Minimum length increased, MFA became mandatory in more contexts. Here is the complete breakdown.
The key password changes in PCI-DSS v4.0
Minimum password length: increased from 7 to 12 characters (Requirement 8.3.6).
MFA: mandatory for all interactive user access to the cardholder data environment, not just remote access (Requirement 8.4.2).
Password history: at least 4 previous passwords must be remembered to prevent reuse.
Change frequency: maximum 90-day rotation (or continuous risk analysis as an alternative).
What this means for your compliance program
If your current password policy sets 8-character minimums, you are out of compliance with PCI-DSS v4.0. Update your policy to require 12 characters minimum, implement MFA for all cardholder data environment access, and document your password quality checks.
