PCI DSS 4.0 Compliance: Authentication Policy Update
To comply with PCI DSS 4.0 security standards and strengthen user account protection, we are updating our authentication policies. These changes, set to take effect in March 2025, will introduce stricter password requirements and adjustments to session management. The update aligns with the latest security standards to reduce the risk of unauthorized access and enhance overall account security.
Key changes
1. Increased password length requirement
The minimum password length will increase from 8 to 12 characters. This new requirement will apply to all newly created and reset passwords, ensuring stronger security for user accounts.
2. Mandatory password change for accounts without 2FA
Users who do not have Two-Factor Authentication (2FA) enabled and are not part of accounts with required SSO must update their password every 90 days. If the password is not updated before expiration, the user will be automatically logged out and must reset their password to regain access.
Follow these steps to regain access to your account:
- Go to the Login Page.
- Enter your credentials and attempt to log in.
- If your password has expired or does not meet the new requirements, the system will notify you that a reset is required.
- A password reset email will be sent to your registered email address. Open the email and click on the provided reset link.
- Follow the instructions on the reset page to create a new password that meets the updated security standards.
- Once your new password is set, you will be automatically logged into your Fundraise Up dashboard.
Frequently Asked Questions (FAQs)
1. Do I need to update my password immediately?
Yes. If your password does not meet the new 12-character minimum, you will be prompted to reset it upon your next login.
2. What happens if I don’t update my password before the 90-day expiration?
You will be automatically logged out and required to reset your password before you can regain access.
3. Can I avoid periodic password resets?
Yes. Enabling Two-Factor Authentication (2FA) allows you to keep your password indefinitely without needing to reset it every 90 days. Learn more about Two-Factor Authentication (2FA).
4. Will these changes affect users with Single Sign-On (SSO)?
- Users in accounts with SSO Required will not be impacted by this update.
- Users in accounts with SSO Optional will be affected, as SSO Optional does not prevent them from logging in with a password.