What it asks for. Requirement 8 of PCI DSS v4.0 covers user identification and authentication for access to system components in the cardholder data environment. It requires unique IDs, management of user and system accounts, strong authentication factors, protection of credentials, multi-factor authentication and controls on application and system accounts, including their use of passwords.
In practice. Organisations assign every user a unique ID, remove or disable accounts promptly, enforce password or passphrase requirements and require multi-factor authentication for access to the cardholder data environment and for remote access. v4.0 extends MFA expectations and adds controls for system and application accounts. Evidence includes account listings, access reviews, MFA configuration and procedures for shared or generic accounts.
Common gaps. Service and application accounts with hard coded or never changed passwords are a common gap. Generic shared accounts also persist without the required justification and controls.