PCI DSS 8.1.3: Manage User IDs Across Full Account Lifecycle

What this means

This control mandates that all user IDs and associated accounts are actively managed and monitored throughout their entire lifecycle—from initial provisioning through deprovisioning. Organizations must establish clear procedures that prevent ID reuse, enforce unique identifiers, document ID assignments, and promptly remove or disable IDs when users leave roles or the organization. The intent is to maintain a current, accurate record of active users with access to cardholder data environments (CDE) and related systems.

How to comply

1. 1.Establish a formal user ID management policy covering creation, modification, suspension, and deletion procedures
2. 2.Implement unique user ID assignment standards that prevent reuse and enable individual accountability
3. 3.Document all user ID assignments with purpose, date, and authorizing manager
4. 4.Create a master inventory of all active user accounts with periodic reviews (at least quarterly)
5. 5.Disable or remove user IDs within a defined timeframe when users are terminated or change roles
6. 6.Prevent deactivated IDs from being reassigned to new users for a minimum retention period
7. 7.Establish naming conventions that facilitate identification of user types (employees, contractors, vendors)
8. 8.Implement approval workflows requiring manager sign-off before ID provisioning or deprovisioning

Evidence auditors look for

• User ID creation and termination request logs with timestamps and approval records
• User access review documentation showing quarterly inventory audits with sign-off
• Policy documentation defining ID lifecycle management procedures and retention periods
• System reports showing active user accounts, creation dates, last login, and suspension status
• Deprovisioning checklist confirming removal from all systems, databases, and physical access
• Evidence of ID deactivation (not deletion) showing compliance with retention requirements
• Access control matrix mapping user IDs to systems and cardholder data access levels
• Training records confirming management awareness of user ID lifecycle responsibilities

Frequently asked questions

GRCWatch automates user ID lifecycle tracking by centralizing provisioning requests, termination workflows, and access reviews in a single platform, eliminating manual spreadsheets and ensuring every ID change is logged and auditable for your PCI DSS assessment.

See how GRCWatch handles this control automatically

Related controls