Announcement:
wanna exchange links? contact me at sapchatroom@gmail.com.
Posted by
Admin at
Question from mjc on Jul 2 at 10:40 AM PCI requirement 8.2.4 requires users to change passwords at least every 90 days. We have established the necessary profile parameters in SAP to enforce this for all "dialog" users. The question we have now is if this requirement also applies to "system" users (i.e., accounts used in RFC connections, etc). Does anyone know of any documentation that addresses this specific issue. My take on it is that as long as the password for the "system" user meets the PCI length/strength requirements, there is no need to enforce a "change password every 90 days" rule on these types of user accounts. Doing so creates more risk than benefit as you would then have to modify RFC connections, etc every 90 days. Thoughts?
Thanks,
Michael
| Reply to this email to post your response. __.____._ |   _.____.__ |
