Comment by clwg

This requirement is in section 8.3.9 of the PCI DSS[0], and only applies to single-factor authentication implementations, two-factor auth removes this requirement.

[0] https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard...