PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/146 of 250
9.3.1.1Physical access for personnel and visitors is authorized and managed
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
Physical access to sensitive areas within the CDE for personnel is controlled as follows:
• Access is authorized and based on individual job function.
• Access is revoked immediately upon termination.
• All physical access mechanisms, such as keys, access cards, etc., are returned or disabled upon termination.
Defined Approach Testing Procedures:
9.3.1.1.a Observe personnel in sensitive areas within the CDE, interview responsible personnel, and examine physical access control lists to verify that:
• Access to the sensitive area is authorized.
• Access is required for the individual’s job function.
9.3.1.1.b Observe processes and interview personnel to verify that access of all personnel is revoked immediately upon termination.
9.3.1.1.c For terminated personnel, examine physical access controls lists and interview responsible personnel to verify that all physical access mechanisms (such as keys, access cards, etc.) were returned or disabled.