jbhall56
05-31-2007, 10:30 AM
We are running into this more an more with our larger clients. They have eDirectory, Active Directory or other LDAP directory where ALL their personnel have an entry. These directories are interfaced to their HR system to automatically generate a directory account when people are hired and delete the account when people are terminated.
Where we run into trouble is that most of these organizations employ seasonal workers and do not remove them from the directory between the seasons because they are not terminated, they are laid off or suspended. As a result, these seasonal workers end up creating a rather large pool of accounts not used in over 90 days ( I have a client that has over 50K+ of these). These people have no access to PCI data of any sort, just access to the organization's HR/Payroll system through kiosks to manage their benefits, deductions and the like.
Right now we're working around this using compensating controls for these organizations. But that is problematic at best as you are not supposed to have compensating controls going on and on, year after year, which is what will happen in this situation.
I'm interested in the group's thoughts of getting 8.5.5 changed to reflect a possibly more realistic approach to the 90 day rule. I would suggest that only those users with access to cardholder data would have to comply.
Coming from the financial institution industry, I whole heartedly agree with the 90 day rule, but I'm having difficulty enforcing it in these situations when no access to sensitive information is not provided.
Where we run into trouble is that most of these organizations employ seasonal workers and do not remove them from the directory between the seasons because they are not terminated, they are laid off or suspended. As a result, these seasonal workers end up creating a rather large pool of accounts not used in over 90 days ( I have a client that has over 50K+ of these). These people have no access to PCI data of any sort, just access to the organization's HR/Payroll system through kiosks to manage their benefits, deductions and the like.
Right now we're working around this using compensating controls for these organizations. But that is problematic at best as you are not supposed to have compensating controls going on and on, year after year, which is what will happen in this situation.
I'm interested in the group's thoughts of getting 8.5.5 changed to reflect a possibly more realistic approach to the 90 day rule. I would suggest that only those users with access to cardholder data would have to comply.
Coming from the financial institution industry, I whole heartedly agree with the 90 day rule, but I'm having difficulty enforcing it in these situations when no access to sensitive information is not provided.