How often must passwords be changed?

How often must passwords be changed?

• A. Every 60 days
• B. At least every 90 days
• C. Every 120 days
• D. Every 365 days

Answer: (B)

Regular password changes limit the window an attacker can use stolen credentials. In PCI DSS, passwords for accounts with access to the cardholder data environment should be changed at least every 90 days. This cadence helps reduce risk by ensuring stolen or guessed passwords don’t remain valid for long, especially in environments handling card data. If a breach or compromise is suspected, change credentials immediately and avoid reusing old passwords. Choices that call for more frequent changes (every 60 days) are stricter than required, while longer intervals (120 days or 365 days) leave credentials valid longer than the standard allows.

Regular password changes limit the window an attacker can use stolen credentials. In PCI DSS, passwords for accounts with access to the cardholder data environment should be changed at least every 90 days. This cadence helps reduce risk by ensuring stolen or guessed passwords don’t remain valid for long, especially in environments handling card data. If a breach or compromise is suspected, change credentials immediately and avoid reusing old passwords. Choices that call for more frequent changes (every 60 days) are stricter than required, while longer intervals (120 days or 365 days) leave credentials valid longer than the standard allows.