9.1 Physical access processes and roles
Requirement 9.1 asks for current policies and procedures for restricting physical access to cardholder data, and documented roles for facility security and media handling.
Requirement 9 Restrict physical access
Requirement 9 covers physical access to facilities and media with cardholder data and protection of card-present payment devices. Each page covers one second-level requirement.
9.2 Facility entry controls
Requirement 9.2 controls entry to facilities and systems holding cardholder data: entry controls, camera or badge monitoring of sensitive areas with three months of retained data, and restrictions on network jacks, wireless hardware and consoles.
9.3 Personnel and visitor physical access
Requirement 9.3 authorizes and manages physical access for personnel and visitors: badge procedures, immediate revocation on termination, escorted and badged visitors, and a visitor log kept for at least three months.
9.4 Media with cardholder data
Requirement 9.4 covers media with cardholder data: physical security, secure offline backup storage with yearly location reviews, classification, tracked transport, management approval, inventories, and destruction of paper and electronic media.
9.5 Point-of-interaction device protection
Requirement 9.5 protects card-present point-of-interaction devices from tampering and substitution: a device list with locations and serial numbers, periodic inspections at a risk-based frequency, and staff training.
