PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/164 of 250
9.5.1.3Point of interaction (POI) devices are protected from tampering and unauthorized substitution
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
Training is provided for personnel in POI environments to be aware of attempted tampering or replacement of POI devices, and includes:
- Verifying the identity of any third-party persons claiming to be repair or maintenance personnel, before granting them access to modify or troubleshoot devices.
- Procedures to ensure devices are not installed, replaced, or returned without verification.
- Being aware of suspicious behavior around devices.
- Reporting suspicious behavior and indications of device tampering or substitution to appropriate personnel.
Defined Approach Testing Procedures:
9.5.1.3.a Review training materials for personnel in POI environments to verify they include all elements specified in this requirement.
9.5.1.3.b Interview personnel in POI environments to verify they have received training and know the procedures for all elements specified in this requirement.