PCI DSS 8.4.1: Require MFA for CDE Administrative Access

What this means

Multi-factor authentication (MFA) must be enforced for all non-console administrative access to systems and devices within your cardholder data environment. Console access (direct keyboard/monitor connections) is exempt, but all remote or networked administrative sessions require at least two different authentication factors—such as something you know (password), something you have (hardware token, phone), or something you are (biometric). This prevents unauthorized personnel from gaining administrative privileges even if passwords are compromised.

How to comply

1. 1.Identify all administrative user accounts with CDE access, including system administrators, database administrators, network administrators, and security staff
2. 2.Select an MFA solution that integrates with your authentication infrastructure—RADIUS servers, LDAP, Active Directory, or cloud identity providers
3. 3.Deploy MFA for all non-console access methods including SSH, RDP, web-based management interfaces, and application admin panels
4. 4.Configure at least two different authentication factors (e.g., password + one-time password token, password + authenticator app, certificate + PIN)
5. 5.Test MFA implementation across all administrative access points to ensure no bypass or workaround paths exist
6. 6.Document which systems, accounts, and access types have MFA enabled and maintain records of configuration
7. 7.Train administrators on MFA usage and establish procedures for backup authentication methods (recovery codes, alternate tokens)
8. 8.Audit and log all successful and failed MFA attempts to detect compromise attempts

Evidence auditors look for

• Screenshots of MFA configuration in Active Directory, Okta, or similar identity platform showing enforced policies for admin accounts
• VPN or bastion host logs showing MFA challenge-response events for administrative sessions
• Network device configurations (firewalls, routers, switches) showing MFA enforcement on CLI/web management access
• SSH server logs (sshd audit logs) demonstrating MFA authentication steps for privileged user logins
• MFA token inventory report listing hardware tokens, software authenticators, or phone-based MFA assigned to each admin
• Access control matrix documenting which admin roles/groups are covered by MFA policy
• Test results or pen-test reports confirming MFA cannot be bypassed and all non-console paths enforce authentication factors

Frequently asked questions

GRCWatch automates MFA policy enforcement across all your CDE systems and continuously audits administrative access logs to prove compliance with PCI DSS 8.4.1 without manual evidence collection.

See how GRCWatch handles this control automatically

Related controls