PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/147 of 250
9.3.2Physical access for personnel and visitors is authorized and managed
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
Procedures are implemented for authorizing and managing visitor access to the CDE, including:
- Visitors are authorized before entering.
- Visitors are escorted at all times.
- Visitors are clearly identified and given a badge or other identification that expires.
- Visitor badges or other identification that visibly distinguishes visitors from personnel.
Defined Approach Testing Procedures:
9.3.2.a Examine documented procedures and interview personnel to verify that procedures are defined for authorizing and managing visitor access to the CDE in accordance with all elements specified in this requirement.
9.3.2.b Observe processes when visitors are present in the CDE and interview personnel to verify that visitors are:
- Authorized before entering the CDE.
- Escorted at all times within the CDE.
9.3.2.c Observe the use of visitor badges or other identification to verify that the badge or other identification does not permit unescorted access to the CDE.
9.3.2.d Observe visitors in the CDE to verify that:
- Visitor badges or other identification are being used for all visitors.
- Visitor badges or identification easily distinguish visitors from personnel.
9.3.2.e Examine visitor badges or other identification and observe evidence in the badging system to verify that visitor badges or other identification have expired.