PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/160 of 250
9.5.1Point of interaction (POI) devices are protected from tampering and unauthorized substitution
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
POI devices that capture payment card data via direct physical interaction with the payment card form factor are protected from tampering and unauthorized substitution, including the following:
- Maintaining a list of POI devices.
- Periodically inspecting POI devices to look for tampering or unauthorized substitution.
- Training personnel to be aware of suspicious behavior and to report tampering or unauthorized substitution of devices.
Defined Approach Testing Procedures:
9.5.1 Examine documented policies and procedures to verify that processes are defined that include all elements specified in this requirement