9.1 Physical access processes and roles: requirements and evidence

What PCI DSS 9.1 asks for and why assessors start with paperwork

If you are preparing for a PCI DSS assessment and need to show that physical access to cardholder data is governed, Requirement 9.1 is where the assessor will start. It contains two sub-requirements. Requirement 9.1.1 asks for the security policies and operational procedures for Requirement 9 to be documented, kept up to date, in use and known to all affected parties. Requirement 9.1.2 asks for the roles and responsibilities for Requirement 9 activities to be documented, assigned and understood. Neither sub-requirement asks you to install a lock or a camera on its own. They ask you to prove that someone has written down how physical access is controlled and who is accountable for each part of it.

The underlying risk is simple to describe and hard to manage. Anyone who can walk into a data center, a back office, a store stockroom or a call center storage room may be able to reach paper records, backup tapes, workstations or devices that hold or touch card data. Physical controls drift over time: badge rules are changed in one building but not documented, a contractor is granted access under an informal arrangement, or a facility team replaces a door system without telling the people who own the procedure. Responsibility is often split across facilities, IT, security and third-party vendors, and each group may assume another owns the task. A policy that is out of date, or a roles record that names people who have left, will fail the test even when the physical controls themselves work.

Start by confirming three things before you engage anyone. First, collect every current document that covers Requirement 9, including the physical security policy and any procedures that sit underneath it, and check the revision dates and approval records. Second, build a roles and responsibilities record, such as a RACI matrix, that names owners for facility security, badge administration, media handling and vendor access, and confirm that each named person knows the duty. Third, ask staff and vendors what they actually do and compare the answers with the written text. Where the documents and practice disagree, fix the gap before the assessment. Your assessor or QSA will judge the evidence, so confirm the expected format with them early.

Which facilities, teams and third parties 9.1 applies to

Requirement 9.1 applies wherever cardholder data or media lives, which is wider than the server room. The cards below walk through the locations, teams and outside parties that bring physical access into the policy and role assignments, and the scoping decisions that change how much work each one creates.

Data centers and server rooms

Any room that houses systems in the cardholder data environment, including on-premises racks, network closets and backup equipment, falls under the physical access policy. Confirm which rooms hold in-scope components by checking the network and data-flow diagrams against the facility floor plan. Where a cloud provider runs the hardware, the policy still needs to say how your staff access the cloud console and any remote management consoles, and who is accountable for each.

Offices with CDE access

Office areas where staff can reach in-scope systems, such as admin workstations, printers that store images, or desks with card data on paper, need documented access rules even if the room itself holds no servers. Ask which teams sit in these areas and whether visitors pass through them. The policy must name who approves access to each area and who reviews it.

Retail and call-center sites

Stores, branches and contact centers that accept card-present payments or take card details by phone are often the locations where cardholder data is most visible. Document which areas are sensitive, such as back offices, cash rooms and agent floors where call recordings or paper notes could expose data. Assign a site manager role for each location so the procedures are known and enforced locally.

Storage rooms and media locations

Rooms used to store backup tapes, paper records, decommissioned drives or printed reports are a common gap because they sit outside IT operations. Include every off-site or on-site storage location in the inventory that 9.1.1 procedures cover. Confirm who holds the keys or badges and which role signs off on removing media.

Work-from-home environments

PCI SSC FAQ 1494 states that a work-from-home environment is not a sensitive area, so home workers do not need to meet Requirements 9.1.1 or 9.3 for their home environments. Your policy should still say that staff must not store cardholder data at home and must follow the remote work rules you set. Verify that home access is limited by other controls, such as no printed card data and devices managed under your other requirements.

Landlords, colocation and facility contractors

Landlords, colocation providers, cleaning and maintenance contractors, and security guard firms may control access to your space or hold keys and badges. Their responsibilities must be assigned in writing, including who issues access cards, who escorts contractors and how incidents are reported. Ask each provider for its access control procedures and review them against your policy at least once a year.

How an assessor tests 9.1.1 and 9.1.2

This table lists how an assessor examines each sub-requirement of Requirement 9.1, the evidence they ask for, and the findings that come up most often. Read each row as a question the assessor will put to you, and prepare the document and the person who can answer it before the assessment starts.

Item	What the assessor does or asks for	Where it usually fails
9.1.1 testing approach	Examines the written physical security policies and operational procedures, then interviews personnel who carry out Requirement 9 tasks to confirm the documents are in use	Documents exist but describe a process nobody follows
9.1.1 evidence to prepare	A current written physical security policy and procedures covering facility entry, visitors and media, with version history and an approval date	Policy is in a shared drive with no owner, review date or revision record
9.1.1 currency check	Evidence the documents were reviewed on a schedule and updated after changes such as a new office, badge system or data center move	Policy still names a decommissioned badge system or a closed site
9.1.2 testing approach	Examines the roles and responsibilities record for Requirement 9 activities, then interviews the people named to confirm they understand their duties	Roles are assigned in an old document but the current owner is unknown
9.1.2 evidence to prepare	A RACI matrix or equivalent record naming who approves access, who revokes badges, who manages visitor logs and who handles media destruction	Matrix lists roles, not named individuals, or lacks a backup for each duty
Common finding: stale policy	Assessor notes procedures that do not match observed practice during walkthroughs or interviews	Procedures were written for the initial assessment and never revised
Common finding: departed owners	Assessor finds named role holders who have left, which means no one is currently accountable for the task	No offboarding step updates the roles record
Common finding: unread procedures	Staff interviewed cannot describe the procedure or say they have never read it	Acknowledgment process is missing or only covers new hires

How to implement 9.1 in a sequence that produces audit evidence

This sequence turns Requirement 9.1 from an unwritten expectation into a dated, approved policy set and a signed roles record that an assessor can examine and test through interviews. Each step closes with a specific artifact so the evidence trail builds as the work proceeds.

Confirm the physical scope from the CDE inputs
Start with the cardholder data environment boundary, the network and data-flow diagrams, and the inventory of locations where cardholder data or the systems that hold it are physically present, including offices, data rooms, storage areas and any sensitive areas. The compliance lead and the facilities owner confirm which sites and media fall under Requirement 9 and record the decision. The step is complete when a signed scope statement lists each physical location and the reason it is in or out, and that statement matches the current diagrams. Ask your QSA or internal assessor to review the scope before drafting begins, because a wrong boundary here carries into every later document.
Draft the Requirement 9 policies and procedures
Write the physical security policy and the operational procedures that support it, covering facility access, personnel and visitor handling, media control and point-of-interaction device protection. The information security or compliance lead drafts the documents, and facilities and operations staff check that each procedure describes what people actually do at the site. The output is a draft document set with version numbers, owners and an effective date field. Where you rely on a customized approach or a different control method, record the objective and how it is met, so the reasoning is available when the document is reviewed.
Assign roles in a RACI matrix
Build a RACI matrix that lists each Requirement 9 activity, such as badge issuance, badge revocation, visitor logging, camera review, media inventory and destruction, and names the person or team that is responsible, accountable, consulted and informed for each. Confirm that every activity has exactly one accountable owner and that named individuals have accepted their roles. The output is a signed or approved RACI with a date and version, which supports the expectation that roles are documented, assigned and understood.
Approve and publish the policy version
Route the policy set and RACI through the governance body that owns security policy, usually a security committee or the executive sponsor named in your program. Record the approval in the document history, including approver name, date and the version being approved. Publish the approved version to the location where affected personnel find policies, and retire superseded drafts so only one current version is in use. The check at this step is that the published location shows the approved version, the approval record exists and older copies are marked as superseded.
Train affected personnel and record acknowledgement
Brief the people named in the RACI and the staff who work in sensitive areas or handle media on the policy and their part in it. Training can be delivered by the security team, facilities leads or a provider, but the organization owns the content and the records. Collect an acknowledgement from each person, either electronically or on paper, that states they have read and understood the policy and their responsibilities. The output is a completed acknowledgement list matched against the personnel roster, with any gaps followed up before the assessment. Remote staff whose home environment is not a sensitive area need the acknowledgement only where their role touches Requirement 9 activities.
Set and run a review cadence
Set a review schedule for the policies, procedures and RACI, with triggers for earlier review such as a site change, a new payment device type, a reorganization or a change in the cardholder data flow. Record each review even when nothing changes, because a dated review entry shows the documents are kept up to date. The output is a review log with the reviewer, date, outcome and any version change. Ask your assessor which review evidence they expect to see in your environment, since the expectation is that documents stay current and in use, and a stale log is one of the most common gaps found in assessments.

Keeping policies current and provable between audits

A Requirement 9.1.1 policy that was correct at the last assessment can still fail the next one if nobody kept it current. The sub-requirement asks for documented security policies and operational procedures that are kept up to date, in use and known to everyone they affect. An assessor will look for the date of the last review, the change history and proof that staff who handle badges, visitors and media work from the same version. Version control is what turns those claims into evidence you can show without reconstructing history from memory. A wiki such as XWiki keeps every change to a page with what changed, when and by whom, lets reviewers compare any two versions, and lets an editor roll back to an earlier one. Those features matter most for the sections that change with the facility: badge issuance steps, visitor escort rules and the contacts for after-hours access. In BookStack, user abilities come from assigned roles, and permissions can be overridden at the shelf, book, chapter or page level. A practical setup is to restrict edit rights on the Requirement 9 book to the named facility and security owners, while everyone else holds read-only access. Confirm the exact role names, audit features and retention settings in each product's current documentation before you rely on them. The tool choice belongs to your organization, and so does the job of making sure the content is right. A version history shows that a procedure changed, not that it reflects what happens at the door. The assessor will still interview staff, compare the documented roles against the RACI matrix and ask whether the procedures match practice. Decide who approves each revision, how often the owner reviews each page and how staff acknowledge the current version, then test those steps before the assessment window opens.

Evidence that passes 9.1 and how to keep it current

An assessor testing 9.1 reads the documents and then asks responsible people how they work. The cards below cover the five records that carry that weight, and each one needs an owner, a review date and a change history to stay credible between assessments.

Approved physical security policy

This is the top-level document that states how your organization restricts physical access to cardholder data and the areas and media that hold it. It should name the scope, the sensitive areas covered and the executive who approved it. Check that the version in use matches the approved one, that it has a stated owner, and that it has a next review date. A policy that describes a building you no longer occupy, or a badge system you replaced, will fail the documentation check.

Operational procedures for each activity

Requirement 9 has several activities, including badge issuance, visitor handling, media storage and destruction, and device inspection. Each one needs a written procedure that staff can follow without asking a colleague. Keep the procedures close to the systems they describe, such as badge administration steps or the destruction vendor's pickup process. Assessors compare these steps with what responsible personnel say they do during interviews, so gaps show quickly.

Roles and responsibilities record

A RACI matrix lists each Requirement 9 activity against the people or teams who are responsible, accountable, consulted and informed. It satisfies the expectation that roles are documented, assigned and understood. Confirm that named individuals still hold their roles, that backups exist for critical activities such as revoking access on termination, and that facilities, security and any outsourced guard or cleaning provider appear where they have real duties.

Training and acknowledgement records

Policies only count if the affected people know them. Keep dated acknowledgement records showing that staff, contractors and facility vendors received the Requirement 9 policy and their procedures, along with the training content used. Assessors often sample a few individuals and ask whether they know their duties. Records should be tied to a current version of the document, so a policy update triggers a new acknowledgement rather than leaving old sign-offs in place.

Review history and change log

The review history proves the documents were checked on schedule and changed when the environment changed. Record each review with its date, reviewer, what was confirmed and any edits made. Version control in a wiki or document system can supply the change trail, recording what changed, when and by whom, and allowing comparison with earlier versions. Confirm that reviews happened at the interval your own policy states, since a missed review date is a visible gap.

What meeting 9.1 costs in money and effort

This table breaks down the cost and effort of meeting Requirement 9.1 into its components, showing who does the work, whether each cost is one-time or recurring, and what pushes it up or down. No figures are given, so use the rows to build the scope you request in quotes. The main takeaway is that most of the cost is staff time, and the number of sites and third parties drives it more than software does.

Cost component	Who is paid, and for what	One-time or recurring, and main drivers
Policy and procedure drafting	Internal security or facilities staff, sometimes legal and an outside consultant for drafting support	One-time to draft, recurring to update. Drivers: number of sites, number of card-present environments, and how many procedures exist today
Legal and facilities review	Legal counsel and facilities managers review procedures for fit with building rules and contracts	One-time for the first version, recurring at each revision. Drivers: leased versus owned premises and landlord constraints
Roles and responsibilities workshops	Internal staff time, with facilitation by a consultant if you request it	One-time to build the RACI matrix, recurring when staff or sites change. Drivers: team size and turnover
Training delivery	Internal trainers or an external provider, plus staff time away from work	Recurring with onboarding and periodic refreshers. Drivers: headcount, third-party staff who need training, and role changes
Documentation platform	License fees for commercial wikis, or no license fee for self-hosted open source. Hosting, administration and backups are paid either way	Recurring. Self-hosted open-source wikis such as XWiki or BookStack can remove license spend, but hosting and administration remain. Confirm version history and access controls with the vendor
Periodic review effort	Policy owners and approvers, with an internal audit or compliance function	Recurring, at the review frequency you set and after material changes. Drivers: number of procedures and whether reviews are tracked in one place
Assessor sampling time	Qualified Security Assessor or internal assessor time to examine documents and interview personnel	Recurring with each assessment. Drivers: number of sites, number of roles to interview, and how quickly you can produce current documents
Outside implementation support	Implementation partner or consultant for documentation structure, evidence preparation and gap review	One-time for setup, optional recurring retainer. Fixed-scope quotes should list deliverables and sites explicitly

Who owns the policy, who prepares the evidence and who tests it

Your organization owns Requirement 9.1 in full. The physical security policy, the operational procedures for restricting access to cardholder data and the roles for facility and media handling are statements your organization makes and must live by. Nobody outside the company can decide who is accountable for badge revocation or who signs off a change to visitor rules.

Policy content: Your security and facilities leaders write and approve the policy and procedures that describe how physical access to cardholder data is restricted.
Role assignments: Named owners are assigned for each Requirement 9 activity, and the responsibilities are understood by the people who carry them out.
Sign-off and review: Management approves the documents and sets the review cadence so they stay current.
Staff accountability: Your managers make sure affected staff know the procedures and follow them, and they handle exceptions.
Interviews: Your responsible personnel must be able to explain their roles to the assessor.

Before any outside party touches the documents, confirm that a named individual can explain every role in the RACI record without reading from it.

Where 9.1 usually fails and how to close each gap

Requirement 9.1 fails less often on missing documents than on documents nobody reads, owners nobody named, and sites that quietly run their own version of the rules. The five gaps below are the ones assessors most often find when they examine policy and procedure documents and interview the people who run the facilities.

Policies that staff never read

A physical security policy can be current and approved yet unknown to the people who guard doors, sign in visitors and handle media. Under 9.1.1 the policy must be in use and known to all affected parties, so an assessor will ask a receptionist, a facilities technician or a shift lead to describe the rule. Check by sampling staff from each role and asking them where the procedure lives and what they do when a visitor has no badge. Fix it with a short role-specific extract, acknowledgment records and a brief walkthrough at onboarding and after each change.

Roles listed without named owners

Many policies assign duties to titles such as facilities manager or security team, but no one can say who covers the role during leave or after a reorganization. Requirement 9.1.2 expects roles and responsibilities to be documented, assigned and understood, which means a named person or a named backup for each activity. Check the roles record against the current org chart and HR list. Fix it with a RACI matrix that names an individual for each Requirement 9 activity, a deputy for each, and a dated owner sign-off.

Documents without review dates

A procedure with no version, approval date or review date gives an assessor no way to tell whether it reflects the facility as it operates today. Badge systems change, camera coverage shifts and vendors rotate, and a document that predates those changes is a finding even if its content was once correct. Check every Requirement 9 document for an owner, version, last review date and next review date. Fix it by setting a review cycle in the document itself and keeping prior versions so the history of changes can be shown.

Procedures that differ between sites

Head office, a warehouse and a branch may each run visitor logs, badge issuance and media storage in their own way. Each variant can be reasonable locally, but a single policy that describes one process while sites run three creates a gap between documentation and practice. Compare the procedure at every in-scope site against the master document and note each deviation. Fix it with one controlling procedure, a short site annex covering only local facts such as door locations and contacts, and a periodic check that sites follow the controlling version.

Third-party facility duties left open

Landlords, building management, cleaning contractors, couriers and security guard firms often touch areas where cardholder data sits, yet their duties appear in no internal document. If a cleaner can enter a server room or a courier collects media without a named internal owner, the entity has no documented control over that access. Check the contracts and site access lists for each external party and ask who approves their entry. Fix it by documenting each third party's access, assigning an internal owner for each relationship, and recording those responsibilities in the roles matrix.

PCI DSS 9.1 questions buyers ask before hiring help

How much effort does PCI DSS 9.1 take to meet?

Effort depends on how many sites, data centers and card-handling areas your organization operates, and how much of that policy material already exists. Requirement 9.1 has two sub-requirements: 9.1.1 asks for documented, current, in-use and known physical security policies and operational procedures, and 9.1.2 asks for documented, assigned and understood roles and responsibilities. Most of the work is writing or updating procedures, getting them approved, distributing them and confirming staff understand them. Organizations with a mature facilities policy set usually spend far less time than those starting from nothing. Ask any provider to break its quote into policy drafting, role mapping, staff acknowledgement and evidence collection so you can see where the hours go.

Can one team handle PCI DSS 9.1 in-house?

Often yes, if the owner of physical security, facilities and the people who handle card media can all be brought into one working group. The 9.1 evidence is documents and a roles record, so the main risk is not technical skill but ownership. Check whether facilities, IT, security and operations each know which parts of the procedure they run. A small team can produce the policy and RACI matrix internally, then ask a Qualified Security Assessor to examine and interview on the assessment date. If your internal team has never worked through a PCI assessment, an outside reviewer can save rework before the assessor arrives.

What does a consultant change about 9.1 compliance work?

A consultant changes the speed and the review quality, not who is accountable. Your organization still owns the policy, the roles and the operation of physical controls. A provider such as DeployOpen can help draft procedures, map roles to named individuals, set up document control and prepare the evidence package, but it does not issue a Report on Compliance or Attestation of Compliance. Only an independent assessor can do that. Keep the consultant separate from the assessor where possible, because a firm that designed the controls is poorly placed to validate them. Ask for the scope, deliverables and timeline in writing before work starts.

Do staff who work from home fall under 9.1?

No, home workplaces are not treated as sensitive areas. PCI SSC FAQ 1494 states that a work-from-home environment is not a sensitive area, so personnel working from home do not need to meet Requirements 9.1.1 or 9.3 for their home environments. This does not remove their obligations under other requirements, such as protecting any card data they handle, access control and policy acknowledgement. Confirm with your assessor how your remote workers are scoped, and document where cardholder data is and is not permitted to be handled, so the boundary is clear in your policy.

Is a self-hosted wiki acceptable evidence for 9.1?

Yes, a self-hosted wiki can hold the policy and procedures, provided the content meets the requirement. Assessors judge what the document says, whether it is current, approved, in use and known to staff, not the software that stores it. Tools such as XWiki keep version history recording what changed, when and by whom, and let users compare and roll back versions. BookStack assigns abilities through roles that can be overridden per shelf, book, chapter or page. Use these features to show approval and review dates, restrict edit rights to the policy owner and keep an access log of who can change the text. Confirm your chosen platform's features in your own environment before relying on them.

How does 9.1 connect to the rest of Requirement 9?

Requirement 9.1 is the governing layer for the other Requirement 9 controls. Sub-requirements 9.2 through 9.5 cover facility entry controls, personnel and visitor access, media with cardholder data, and point-of-interaction device protection. Each of those needs procedures and assigned responsibilities, and 9.1 is where those procedures and roles are written down. An assessor will often trace from the policy in 9.1 into the operational evidence for the other sub-requirements, such as visitor logs, media inventories and device inspection records. Build the 9.1 documents so they name the owner of each later control, which makes the assessment easier to follow.

What should I ask a provider about 9.1 before signing?

Ask for a written scope that lists the sites, facilities and card-handling areas covered, the documents to be produced, and who approves them. Confirm which deliverables are policy drafts, which are role records and which are evidence packs, and whether staff training or acknowledgement is included. Ask how the provider keeps your documents under version control and who keeps the final copies. Finally, confirm that the provider will not issue the assessment report and that your QSA will examine and interview your staff directly. A clear written scope is the most useful way to compare quotes.

How DeployOpen prepares 9.1 documentation and evidence

DeployOpen works on 9.1 Physical access processes and roles as a preparation partner. We help you write the policies, procedures and roles record that an assessor will examine, while your organization owns the controls and an independent QSA judges them. Our work is scoped in writing before it starts.

How we scope

Agree in writing which facilities, media stores and personnel groups fall under the 9.1 policy and procedures.
Confirm which sensitive areas and home-based staff are included, using the work-from-home boundary in PCI SSC guidance.
List the responsible owners for facility security and media handling so the roles scope is settled before drafting.

How we build

Draft the physical security policy and operational procedures for Requirement 9 in your environment's language and process.
Build a roles and responsibilities record, such as a RACI matrix, that maps each Requirement 9 activity to a named role.
Set up version-controlled documentation so each revision shows what changed, when and by whom, with approvals recorded.

How we hand over

Deliver the final policies, procedures and roles record in the formats your team will maintain and assessors can examine.
Walk responsible personnel through their documented duties so the content can be explained in an assessor interview.
Provide a gap list of anything still unassigned, outdated or not yet known to affected staff, with owners for each item.

How we support

Support ongoing reviews of 9.1 documents as facilities, staff or media handling processes change, under a retainer if you want it.
Answer assessor questions about how the documentation was prepared, while the QSA remains responsible for the assessment.
Confirm with your QSA which evidence formats and review cadence they expect before the next assessment cycle.

9.1 Physical access processes and roles