PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/145 of 250
9.2.4Physical access controls manage entry into facilities and systems containing cardholder data
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
Access to consoles in sensitive areas is restricted via locking when not in use.
Defined Approach Testing Procedures:
9.2.4 Observe a system administrator’s attempt to log into consoles in sensitive areas and verify that they are “locked” to prevent unauthorized use.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.