PCI DSS makes no room for guesswork, especially when it comes to passwords. If you handle cardholder data, you follow their rules — or you face fines, audits, and lost trust. One of the most overlooked but critical requirements: how and when passwords must be changed.
What PCI DSS Says About Password Rotation
PCI DSS requires passwords to be changed at least every 90 days. Default passwords are never allowed in production. New passwords must be unique — no reusing the last four. Accounts must be locked after repeated failed attempts, and sessions must expire after a set time. These rules close the gaps attackers use when they guess or steal credentials.
Why Strong Rotation Policies Matter
Long-lived passwords become targets. Credential dumps, phishing kits, and brute-force attacks get better every year. If a password lasts forever, an old leak can still open the door to your systems months or years later. Rotation limits the lifespan of stolen credentials. Combined with complexity requirements, it raises the cost for attackers and reduces their window of success.
Common Mistakes to Avoid
Many teams rotate passwords on paper but not in practice. Admin accounts get skipped. Service accounts are left untouched because changing them is “too disruptive.” Old passwords remain valid in forgotten test environments. All of these break PCI DSS compliance and weaken the entire control. Automated enforcement is not optional — it’s the only way to make the rule real.