Should a merchant console still force password changes every 90 days?

Not when multi-factor authentication is in place. PCI DSS v4.0.1 requires 90-day rotation only when a password is the single authentication factor, and NIST SP 800-63B recommends changing passwords only on evidence of compromise. Enforcing MFA for every console user removes the need for forced rotation.

What the standards say now

PCI DSS v4.0.1 requires changing passwords at least every 90 days only when a password is the sole authentication factor for a user account. When multi-factor authentication is in place, or when the account's security posture is analyzed dynamically, the rotation requirement does not apply. NIST SP 800-63B goes further and recommends changing passwords only on evidence of compromise, because forced rotation leads to predictable patterns.

The practical rule

• Enforce multi-factor authentication for every console user, operators, program managers and merchants.
• Drop forced periodic rotation once MFA is in place.
• Force a change immediately when a compromise is suspected, for example after a phishing incident.
• Screen new passwords against lists of known breached passwords.

Why it matters for payment platforms

A merchant console gives access to transactions, refunds and payouts. The threat is credential theft through phishing or reuse, which rotation does not stop and MFA does. Operators that still enforce 90-day changes without MFA are meeting an old requirement while leaving the real risk open. The assessor will ask how each account is protected; MFA everywhere is the answer that satisfies both the standard and the threat model.