Compliancemanzill.com
PCI DSS v4.0

PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/162 of 250

9.5.1.2Point of interaction (POI) devices are protected from tampering and unauthorized substitution

Control family: Requirement 09: Restrict Physical Access to Cardholder Data

Control description

Defined Approach Requirements:

POI device surfaces are periodically inspected to detect tampering and unauthorized substitution.

Defined Approach Testing Procedures:

9.5.1.2.a Examine documented procedures to verify processes are defined for periodic inspections of POI device surfaces to detect tampering and unauthorized substitution.

9.5.1.2.b Interview responsible personnel and observe inspection processes to verify:

Personnel are aware of procedures for inspecting devices.

All devices are periodically inspected for evidence of tampering and unauthorized substitution.

How to implement

Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.