PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/148 of 250
9.3.3Physical access for personnel and visitors is authorized and managed
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
Visitor badges or identification are surrendered or deactivated before visitors leave the facility or at the date of expiration.
Defined Approach Testing Procedures:
9.3.3 Observe visitors leaving the facility and interview personnel to verify visitor badges or other identification are surrendered or deactivated before visitors leave the facility or at the date of expiration. upon departure or expiration.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.