I've got a current problem at work (i'm an IT manager) whereby users are logging into some of our systems using an account which is actually someone elses.
We have to be PCI compliant (you should probably note this).
Most of the internal systems i've sorted (but advise is always welcome on this too).
The current issue relates to an
external email campaign system that contains some customer information, users are using a single account that is actually designed for one person.
I believe every user should be logging in with their own username and password regardless of cost.
I need some information to back me up, and wondered just how legal it is to login as someone else to this kind of system?
I would have thought it's not PCI compliant or legal?