PCI DSS Requirement 9: Physical Security of Cardholder Data and POI Devices

Requirement Structure

Deep Dives

• 9.2.1 / 9.2.1.1 - Facility entry controls restrict physical access to CDE systems; monitor individual access to sensitive areas with video cameras and/or physical access mechanisms; protect monitors from tampering; review and correlate collected data; store for at least three months unless otherwise restricted by law.
• 9.2.2-9.2.4 - Restrict use of publicly accessible network jacks; restrict physical access to wireless access points, gateways, networking/communications hardware, and telecommunication lines; lock consoles in sensitive areas when not in use.
• 9.3.1 / 9.3.1.1 - Authorize and manage personnel physical access (identify, change, revoke); control sensitive-area access by job function; revoke immediately upon termination; return or disable keys and access cards.
• 9.3.2-9.3.4 - Visitors authorized before entry, escorted at all times, clearly identified with expiring badges that distinguish visitors from personnel; surrender or deactivate badges on leave or expiry; visitor log (name, organization, date/time, authorizing personnel) retained at least three months unless restricted by law.
• 9.4.1-9.4.1.2 - Physically secure media with CHD; store offline media backups in a secure location; review backup-location security at least once every 12 months.
• 9.4.2-9.4.5.1 - Classify media by sensitivity; log and track media sent outside via secured courier or tracked delivery; management approval for offsite moves; maintain inventory of electronic media with CHD; inventory at least annually.
• 9.4.6 / 9.4.7 - Destroy hard-copy materials (cross-cut shred, incinerate, or pulp; secure containers before destruction) and electronic media (destroy the media or render CHD unrecoverable) when no longer needed for business or legal reasons. Separate from Requirement 3.2.1 retention deletion.
• 9.5.1 / 9.5.1.1-9.5.1.3 - Maintain a POI device list (make/model, location, unique ID); periodically inspect surfaces for tampering or unauthorized substitution; define inspection frequency and type in a 12.3.1 TRA (9.5.1.2.1 mandatory since 31 March 2025); train POI personnel to verify third-party repair identities, prevent unauthorized install/replace, recognize suspicious behavior, and report issues.

How CyberSilo Helps

• Compliance Standards Automation - physical, media, and POI evidence checklists and review cadence
• USA v4.0.1 readiness services - facility and retail POI program gap remediation

Frequently Asked Questions

Does Requirement 9 apply to smartphones used as payment terminals?

9.5.1 does not apply to commercial off-the-shelf (COTS) devices such as smartphones or tablets designed for mass-market distribution. Confirm device classification with your QSA.

Is shredding CHD printouts the same as Requirement 3 retention deletion?

No. 9.4.6 and 9.4.7 cover destruction of media when that media is no longer needed for business or legal reasons. Requirement 3.2.1 covers retention and secure deletion of stored account data per the entity's retention policies.

How long must visitor logs and sensitive-area access recordings be kept?

At least three months unless otherwise restricted by law (9.2.1.1 for monitoring data and 9.3.4 for visitor logs).

Related PCI Resources

PCI DSS hub · 12 requirements explained · Requirement 3 · Requirement 12