PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/161 of 250
9.5.1.1Point of interaction (POI) devices are protected from tampering and unauthorized substitution
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
An up-to-date list of POI devices is maintained, including:
- Make and model of the device.
- Location of device.
- Device serial number or other methods of unique identification
Defined Approach Testing Procedures:
9.5.1.1.a Examine the list of POI devices to verify it includes all elements specified in this requirement.
9.5.1.1.b Observe POI devices and device locations and compare to devices in the list to verify that the list is accurate and up to date.
9.5.1.1.c Interview personnel to verify the list of POI devices is updated when devices are added, relocated, decommissioned, etc.