On which date did broken authentication and session management become a formal requirement?

On which date did broken authentication and session management become a formal requirement?

• A. January 1, 2016
• B. June 30, 2014
• C. June 30, 2015
• D. December 31, 2015

Answer: (C)

This item is about when PCI DSS formally began requiring protections for authentication and how sessions are managed. Broken authentication and session management means putting solid safeguards around login credentials and how user sessions are created, maintained, and terminated to prevent attackers from gaining access. Implementing strong authentication methods, protecting and rotating credentials, ensuring sessions time out, and requiring re-authentication for sensitive actions are all part of this. The formal requirement date is June 30, 2015, which is when the standard was updated to codify broken authentication and session management as an official requirement. The other dates don’t match the official adoption date of this provision, so they aren’t correct.

This item is about when PCI DSS formally began requiring protections for authentication and how sessions are managed. Broken authentication and session management means putting solid safeguards around login credentials and how user sessions are created, maintained, and terminated to prevent attackers from gaining access. Implementing strong authentication methods, protecting and rotating credentials, ensuring sessions time out, and requiring re-authentication for sensitive actions are all part of this.

The formal requirement date is June 30, 2015, which is when the standard was updated to codify broken authentication and session management as an official requirement. The other dates don’t match the official adoption date of this provision, so they aren’t correct.