PCI DSS 4.0 8.2.2: 8.2.2 Shared and generic IDs only by exception
Group, shared or generic IDs, and any other shared authentication credentials, may be used only where needed as an exception, and must be managed so that: use of the ID is blocked unless an exceptional circumstance calls for it; use lasts only as long as the exceptional circumstance requires; a business justification is documented; management explicitly approves the use; the identity of the individual is verified before the account is made available; and every action taken is attributable to one individual user. The guidance suggests password vaults or controls like sudo, and gives a break-glass emergency account as an example of an exception. Applicability: not intended for point-of-sale terminal user accounts that are limited to a single card number per transaction. Objective under the customized approach: all actions carried out with group, shared or generic IDs can be attributed to an individual person.
This control maps to 38 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
You are reading one control. How much of PCI DSS 4.0 have you already done?
PCI DSS 4.0 8.2.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.