PCI compliance - Acceptability of Shared User Accounts

Greetings-

Forgive me if this post was submitted to the wrong place.

My question/concern is about sharing accounts between multiple users... so the scenario is.. one username/password may be shared by 3 or more people (within reason, of course).

We are just beginning the implementation process and I have a question about User Accounts going forward. We have a central location, and 26 or so historic 'sites' located throughout Minnesota. We have legions of people who work for us that can be categorized as part-time, seasonal, volunteer, intern, etc...

As you can see, maintaining all of these people who come and go at various intervals with a separate, and possibly short-lived username/password, could turn into a nightmare. I'm wondering if anyone knows about any PCI compliance guidelines that can be followed that either reenforce the 'shared login' practice, or strictly prohibit the practice in a system like Tessitura.

Or... if anyone has any advice or tips on the subject, feel free to let me know!

Thanks!

Jason

Minnesota Historical Society

Parents Reply Children
No Data