PCI DSS · Requirement 8: Identify users and authenticate access to system components
8.2.8
Re-authentication after 15 minutes idle
frameworkPCI DSS v4.0.1
sectionRequirement 8: Identify users and authenticate access to system components
csf 2.0PR.AA-03 PR.DS-10
topics—
frameworks0 0 0
Official text · not licensableSummary (ControlMapping's wording): Re-authentication after 15 minutes idle. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.AA-03PR.DS-10 | Users, services, and hardware are authenticated; The confidentiality, integrity, and availability of data-in-use are protected | No mapping. Only shares CSF PR.AA-03, PR.DS-10: related, not a mapping | |
| ISO 27001 | A.5.15A.5.3A.5.10A.5.13 | Access control; Segregation of duties… | No mapping. Only shares CSF PR.AA-03, PR.DS-10: related, not a mapping+17 more loosely related (not mappings)…and 13 more in the downloads | |
| CIS v8.1 | CIS 3.1CIS 3.4CIS 3.5CIS 3.12 | Establish and Maintain a Data Management Process; Enforce Data Retention… | No mapping. Only shares CSF PR.DS-10: related, not a mapping+8 more loosely related (not mappings)CIS 6.3 Require MFA for Externally-Exposed Applications Only shares CSF PR.AA-03: related, not a mapping …and 4 more in the downloads | |
| SOC 2 | C1.2CC6.1CC6.5CC6.6 | Disposing of confidential information; Logical access security over information assets… | No mapping. Only shares CSF PR.DS-10, PR.AA-03: related, not a mapping+1 more loosely related (not mappings)CC6.7 Restricting transmission, movement and removal of information Only shares CSF PR.DS-10: related, not a mapping | |
| CMMC | AC.L2-3.1.1AC.L2-3.1.2AC.L2-3.1.3AC.L2-3.1.8 | Authorized Access Control; Transaction & Function Control… | No mapping. Only shares CSF PR.DS-10, PR.AA-03: related, not a mapping+25 more loosely related (not mappings)…and 21 more in the downloads | |
| 800-53 | SI-10AC-2AC-3AC-4 | Information Input Validation; Account Management… | No mapping. Only shares CSF PR.AA-03, PR.DS-10: related, not a mapping+31 more loosely related (not mappings)…and 27 more in the downloads | |
| HIPAA | §164.310(b)§164.312(a)(2)(i)§164.308(a)(1)(ii)(D)§164.308(a)(3) | Workstation Use; Unique User Identification… | No mapping. Only shares CSF PR.AA-03, PR.DS-10: related, not a mapping+22 more loosely related (not mappings)§164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF PR.DS-10: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Only shares CSF PR.DS-10: related, not a mapping …and 18 more in the downloads | |
| GDPR | Art.5(1)(e)Art.5(1)(f)Art.32(1)(b) | Principles relating to processing of personal data; Principles relating to processing of personal data… | No mapping. Only shares CSF PR.DS-10: related, not a mapping | |
| NIS2 | 11.611.7 | Authentication; Multi-factor authentication | No mapping. Only shares CSF PR.AA-03: related, not a mapping | |
| Essential Eight | ISM-0974ISM-1173ISM-1401ISM-1504 | Multi-factor authentication is used to authenticate unprivileged human users of systems; Multi-factor authentication is used to authenticate privileged human users of systems… | No mapping. Only shares CSF PR.AA-03: related, not a mapping+12 more loosely related (not mappings)ISM-1505 Multi-factor authentication is used to authenticate human users of data repositories Only shares CSF PR.AA-03: related, not a mapping ISM-1679 Multi-factor authentication is used to authenticate human users to third-party online services that process, store or… Only shares CSF PR.AA-03: related, not a mapping ISM-1680 Multi-factor authentication (where available) is used to authenticate human users to… Only shares CSF PR.AA-03: related, not a mapping ISM-1681 Multi-factor authentication is used to authenticate customers to online customer… Only shares CSF PR.AA-03: related, not a mapping …and 8 more in the downloads | |
| DORA | Art.9(2)Art.9(3)(c)Art.9(3)(d)Art.9(4)(d) | Protection and prevention; Protection and prevention… | No mapping. Only shares CSF PR.DS-10, PR.AA-03: related, not a mapping | |
| CPS 234 | Para 21 | Timely controls commensurate with risk and asset life-cycle | No mapping. Only shares CSF PR.DS-10: related, not a mapping | |
| Cyber Essentials | CE 4 | User Access Control | No mapping. Only shares CSF PR.AA-03: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.