TL;DR
- PCI DSS Requirement 9 protects cardholder data by restricting physical access to facilities, systems, storage media, and point-of-interaction (POI) devices.
- Version 4.0.1 adds a risk-based inspection schedule for POI devices under Requirement 9.5.1.2.1, which has been mandatory since March 31, 2025.
- Assessors expect working evidence, including access logs, visitor records, media inventories, destruction records, and device inspection logs.
PCI DSS Requirement 9 requires organizations to restrict physical access to cardholder data, including the facilities, systems, media, and payment devices that store, process, or transmit it. The requirement assumes that strong logical controls lose their value once an attacker can touch a server, copy a backup tape, or tamper with a card reader.
Physical threats remain practical and inexpensive for criminals. Skimming devices, stolen laptops, unshredded paper records, and unsupervised visitors in server rooms all create direct paths to card data. Requirement 9 works alongside logical access controls, such as those in PCI DSS Requirement 8 for MFA and password policy, to make sure only authorized people reach sensitive assets.
For organizations hosting their cardholder data environment in the cloud, many physical controls are inherited from the cloud provider. These organizations must still document that responsibility split and protect any office, store, call center, or device that remains under their control.
What Are The Five Sub-Requirements Of PCI DSS Requirement 9?
PCI DSS v4.0.1 organizes Requirement 9 into five sub-requirements that move from governance to facilities, people, media, and payment devices. Each sub-requirement builds on the one before it.
- 9.1 Processes and responsibilities: Security policies and operational procedures for physical security must be documented, kept current, in use, and known to all affected parties, with roles and responsibilities assigned.
- 9.2 Facility and system entry controls: Organizations must use appropriate entry controls for facilities and systems in the cardholder data environment. Controls include video cameras or access control mechanisms for sensitive areas, restricted network jacks, protected networking hardware, and locked consoles when unattended.
- 9.3 Personnel and visitor access: Physical access must be authorized, managed, and revoked promptly when personnel leave. Visitors must be authorized, escorted, given expiring badges, and recorded in a visitor log retained for at least three months.
- 9.4 Media protection: All media containing cardholder data must be physically secured, classified, tracked during transport, inventoried, and destroyed when no longer needed. Our guide to PCI DSS Requirement 3 explains the stored data rules that determine which media falls in scope.
- 9.5 Point-of-interaction devices: Card-reading devices must be protected from tampering and unauthorized substitution through device inventories, periodic inspections, and staff training.
What Changed In Requirement 9 Under PCI DSS v4.0.1?
The most significant change in Requirement 9 is the shift to a risk-based schedule for inspecting POI devices, supported by clearer structure and stronger language across several existing controls. PCI DSS v4.0 introduced these updates, and v4.0.1 kept them with minor clarifications.
Key changes include:
- Requirement 9.1.2: Roles and responsibilities for physical security activities must be documented, assigned, and understood.
- Requirement 9.2.4: Consoles in sensitive areas must be locked when unattended, which strengthens earlier guidance.
- Requirement 9.4.6 and 9.4.7: Destruction rules are now separate for hard-copy media and electronic media, with electronic media rendered unrecoverable through destruction or secure wiping.
- Requirement 9.5.1.2.1: Organizations must set the frequency and type of POI device inspections through a targeted risk analysis under Requirement 12.3.1. This requirement has been mandatory since March 31, 2025.
Assessors now expect the targeted risk analysis to reflect each device’s environment, including foot traffic, whether staff can see the device, and public access. A single generic inspection frequency applied to every store will usually draw follow-up questions during fieldwork.
How Should Organizations Protect POI Devices From Tampering Under Requirement 9.5?
Organizations protect POI devices by maintaining a complete device inventory, inspecting devices at a risk-based frequency, and training staff to recognize tampering and social engineering. These three controls work together, and a weakness in one undermines the other two.
A practical POI device protection program includes:
- Device inventory: Record the make, model, location, and serial number or unique identifier for every device, and update the list whenever devices move or change.
- Risk-based inspections: Inspect unattended and high-traffic devices, such as self-checkouts and fuel pumps, more often than devices in locked or staffed areas.
- Inspection method: Check serial numbers, security seals, casing, cables, and attachments, and compare each device against reference photos.
- Staff awareness: Train personnel to verify the identity of repair technicians and report suspicious behavior through the incident response process.
The PCI SSC skimming prevention guidance offers merchant-focused tips that complement these controls. Organizations using validated PCI P2PE solutions should also follow the device handling instructions in their P2PE Instruction Manual.
What Evidence Do QSAs Request When Assessing Requirement 9?
QSAs assess Requirement 9 by reviewing documents, observing physical controls in person, and sampling records to confirm that controls operated throughout the assessment period. Written policies alone will not satisfy the testing procedures, because assessors must see each control working in practice at a sample of locations.
Typical evidence requests include:
- Access records: Badge system logs and video retention settings showing that data from sensitive areas is kept for at least three months. Organizations can align these records with their broader PCI DSS logging and monitoring program.
- Personnel and visitor records: Access approval and revocation records, visitor logs, and badge return procedures.
- Media records: Media classification, transport logs, inventories conducted at least every 12 months, and destruction certificates.
- Device records: POI device inventories, inspection logs, the targeted risk analysis, and training completion records.
- Observation: Walkthroughs of data centers, server rooms, stores, and call centers to confirm locks, cameras, escorts, and secured consoles.
The official testing procedures appear in the PCI DSS v4.0.1 standard, available through the PCI SSC Document Library.
| Close your Requirement 9 gaps before your next assessment with Ampcus Cyber’s PCI DSS compliance services, led by experienced QSAs. |
People Also Ask
Does PCI DSS Requirement 9 apply to cloud-hosted environments?
Requirement 9 applies to every in-scope location. Cloud providers usually cover data center controls, while the customer remains responsible for offices, stores, devices, and media under its control.
How long must visitor logs be retained under PCI DSS?
Visitor logs must be retained for at least three months, unless a law or regulation restricts retention.
How often should POI devices be inspected?
PCI DSS v4.0.1 requires organizations to define inspection frequency through a targeted risk analysis, with unattended and high-traffic devices typically inspected daily.
What is the difference between Requirement 9.4.6 and 9.4.7?
Requirement 9.4.6 covers the destruction of hard-copy materials, while Requirement 9.4.7 covers electronic media, which must be destroyed or rendered unrecoverable.
Enjoyed reading this blog? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.
