Since 2025-03-31, PCI DSS requires multi-factor authentication (MFA) for far more people than before. Under earlier versions, MFA was mainly expected for administrators and for remote access from outside the network. Requirement 8.4.2 extends it to all access into the cardholder data environment (CDE). For many organizations, this was the most visible change in PCI DSS v4.
What requirement 8.4.2 says, in plain terms
MFA has to be used for all non-console access into the CDE, for any role, from any location, inside the network or outside it. The requirement was introduced in v4.0 as a best practice and became mandatory on 2025-03-31, along with the other future-dated requirements.
In practice, a store supervisor, a customer service agent, a developer or a vendor’s technician who logs in to a system in the CDE must use MFA, not just the IT administrators. Assessment firms note that it covers cloud environments, hosted systems, on-premises applications, network devices, servers and workstations that make up the CDE.
What “access into the CDE” means
The key word is into. MFA is applied at the point where a person crosses into the CDE. If your network is segmented and the CDE is reached through a jump server or a dedicated access point, MFA at that entry point can satisfy the requirement. If the CDE is flat and mixed with the rest of the office network, the number of systems where MFA is needed grows quickly. This is one reason good segmentation pays off.
Remote access from outside your network into any part of the environment still requires MFA under a separate requirement. Some users will therefore pass MFA more than once: once to get onto the network, and again to get into the CDE.
What changed in v4.0.1
The limited revision published in 2024 added a note on MFA and phishing-resistant authentication factors, and added a definition of “phishing-resistant authentication” to the glossary. If your organization has adopted phishing-resistant methods, such as hardware security keys or platform authenticators based on public-key cryptography, review the note with your assessor to see how it applies to you.
How the MFA system itself must be configured
MFA that can be bypassed is not MFA. PCI DSS requirement 8.5.1 sets out how the system must work. In summary, it must resist replay attacks, prevent bypass unless specifically approved by management, use at least two different types of factors, and grant access only when all factors succeed.
The independence of factors matters. The Council’s earlier guidance explains that “access to one factor does not grant access to any other factor”. For example, sending a one-time code to an email inbox that opens with the same password the user just typed does not give two independent factors.
Common problems we see
- Shared or generic accounts that cannot be tied to an individual and therefore cannot use MFA properly.
- Vendor remote access tools left outside the MFA solution “because the vendor needs quick access”.
- Legacy applications in the CDE that do not support MFA and were never placed behind an MFA-protected access point.
- “Remember this device” settings that silently skip the second factor for long periods.
- Emergency (break-glass) accounts with no documented approval or monitoring.
A practical implementation path
- Map who accesses the CDE and how. Include employees, contractors and service providers.
- Reduce the entry points. Route access through as few controlled gateways as possible.
- Choose MFA methods that fit each group of users. Prefer phishing-resistant methods for privileged users.
- Document exceptions. Any bypass needs management approval, a time limit and a record.
- Test it. Try to reach CDE systems without MFA, and include this scenario in your penetration test.
- Keep evidence. Configuration screenshots, access logs and user lists will be requested at assessment time.
For more context, see our PCI DSS overview. Ubitrak assesses MFA as part of its PCI DSS assessments and can test access paths during penetration testing. If you need help selecting or rolling out an MFA solution, KW Consulting supports remediation projects. Contact us to get started.
Sources
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult