PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/165 of 250
9.3.1Physical access for personnel and visitors is authorized and managed
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
Procedures are implemented for authorizing and managing physical access of personnel to the CDE, including:
- Identifying personnel.
- Managing changes to an individual's physical access requirements.
- Revoking or terminating personnel identification.
- Limiting access to the identification process or system to authorized personnel.
Defined Approach Testing Procedures:
9.3.1.a Examine documented procedures to verify that procedures to authorize and manage physical access of personnel to the CDE are defined in accordance with all elements specified in this requirement.
9.3.1.b Observe identification methods, such as ID badges, and processes to verify that personnel in the CDE are clearly identified.
9.3.1.c Observe processes to verify that access to the identification process, such as a badge system, is limited to authorized personnel