PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/149 of 250
9.3.4Physical access for personnel and visitors is authorized and managed
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
A visitor log is used to maintain a physical record of visitor activity within the facility and within sensitive areas, including:
- The visitor's name and the organization represented.
- The date and time of the visit.
- The name of the person authorizing physical access.
- Retaining the log for at least three months, unless otherwise restricted by law.
Defined Approach Testing Procedures:
9.3.4.a Examine the visitor log and interview responsible personnel to verify that a visitor log is used to record physical access to the facility and sensitive areas.
9.3.4.b Examine the visitor log and verify that the log contains:
- The visitor's name and the organization represented.
- The personnel authorizing physical access.
- Date and time of visit.
9.3.4.c Examine visitor log storage locations and interview responsible personnel to verify that the log is retained for at least three months, unless otherwise restricted by law.