8.2.5 Access for terminated users is immediately revoked.

Defined Approach Requirements

8.2.5 Access for terminated users is immediately revoked.

Customized Approach Objective

The accounts of terminated users cannot be used.

Defined Approach Testing Procedures

8.2.5.a Examine information sources for terminated users and review current user access lists—for both local and remote access—to verify that terminated user IDs have been deactivated or removed from the access lists.

8.2.5.b Interview responsible personnel to verify that all physical authentication factors—such as, smart cards, tokens, etc.—have been returned or deactivated for terminated users.

Purpose

If an employee or third party/vendor has left the company and still has access to the network via their user account, unnecessary or malicious access to cardholder data could occur—either by the former employee or by a malicious user who exploits the old and/or unused account.