How often must passwords be changed?

How often must passwords be changed?

• A. Change only if compromised.
• B. Change every 360 days.
• C. Change at least every 90 days.
• D. Non-consumer passwords are not required to change.

Answer: (C)

Regular rotation of passwords limits how long a stolen credential can be used. PCI DSS sets a maximum password age of 90 days, so you must require changes at least every 90 days. This proactive practice helps reduce the risk from compromised credentials. If a compromise is suspected, an immediate change is required regardless of the schedule. Changing only if compromised leaves a window for misuse; 360 days is too long and weak; and the idea that non-consumer passwords aren’t required to change contradicts PCI DSS requirements for access to cardholder data. Therefore, the best practice is to enforce changes at least every 90 days.

Regular rotation of passwords limits how long a stolen credential can be used. PCI DSS sets a maximum password age of 90 days, so you must require changes at least every 90 days. This proactive practice helps reduce the risk from compromised credentials. If a compromise is suspected, an immediate change is required regardless of the schedule.

Changing only if compromised leaves a window for misuse; 360 days is too long and weak; and the idea that non-consumer passwords aren’t required to change contradicts PCI DSS requirements for access to cardholder data. Therefore, the best practice is to enforce changes at least every 90 days.