An organization wishes to implement multi-factor authentication for remote access, using the user's Individual password and a digital certificate…

​ Multi-Factor Authentication (MFA)

MFA requires at least two factors from different categories: something you know (password),

something you have (digital certificate), or something you are (biometric).

PCI DSS Requirement 8 mandates that credentials like certificates must be unique to each user​​.

​ Secure Certificate Use

Certificates must not be shared and should be assigned individually to ensure accountability and

prevent unauthorized access.

​ Incorrect Options

Option A: Limiting certificates to administrative groups does not fulfill PCI DSS for all users.

Option C: Logging certificates for retrieval is unrelated to security requirements.

Option D: Certificates do not have a mandatory 90-day change requirement.