PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/142 of 250
9.2.1.1Physical access controls manage entry into facilities and systems containing cardholder data
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
Individual physical access to sensitive areas within the CDE is monitored with either video cameras or physical access control mechanisms (or both) as follows:
- Entry and exit points to/from sensitive areas within the CDE are monitored.
- Monitoring devices or mechanisms are protected from tampering or disabling.
- Collected data is reviewed and correlated with other entries.
- Collected data is stored for at least three months, unless otherwise restricted by law.
Defined Approach Testing Procedures:
9.2.1.1.a Observe locations where individual physical access to sensitive areas within the CDE occurs to verify that either video cameras or physical access control mechanisms (or both) are in place to monitor the entry and exit points.
9.2.1.1.b Observe locations where individual physical access to sensitive areas within the CDE occurs to verify that either video cameras or physical access control mechanisms (or both) are protected from tampering or disabling.
Observe the physical access control mechanisms and/or examine video cameras and interview responsible personnel to verify that:
- Collected data from video cameras and/or physical access control mechanisms is reviewed and correlated with other entries.
- Collected data is stored for at least three months.