Physical Security

Learn how specific controls protect people, processes, locations, and technology from physical loss or damage.

PCI Requirement 9 – Restrict Physical Access to Cardholder Data.mp4
PCI Requirement 9.1 – Use Facility Entry Controls to Limit Physical Access to CDE
PCI Requirement 9.1.1 – Use Video Cameras or Access Control Mechanisms to Monitor Physical Access
PCI Requirement 9.1.2 – Implement Physical Controls to Restrict Access to Accessible Network Jacks
PCI Requirement 9.1.3 – Restrict Physical Access to Wireless Access Points
PCI Requirement 9.2 – Develop Procedures to Easily Distinguish Between Onsite Personnel and Visitors
PCI Requirement 9.3 – Control Physical Access for Onsite Personnel to Sensitive Areas
PCI Requirement 9.4 – Implement Procedures to Identify and Authorize Visitors
PCI Requirement 9.4.1 – Visitors are Authorized Before Entering, and Escorted at all Times
PCI Requirement 9.4.2 – Visitors are Identified and Given a Badge that Expires
PCI Requirement 9.4.3 – Visitors are Asked to Surrender the Badge Before Leaving the Facility
PCI Requirement 9.4.4 – A Visitor Log is Used to Maintain a Physical Audit Trail of Visitor Activity
PCI Requirement 9.5 – Physically Secure all Media
PCI Requirement 9.5.1 – Store Media Backups in a Secure Location and Review the Location’s Security
PCI Requirement 9.6 – Maintain Control Over the InternalExternal Distribution of Any Kind of Media
PCI Requirement 9.6.1 – Classify Media so the Sensitivity of the Data Can Be Determined
PCI Requirement 9.6.2 – Send the Media by Secured Courier
PCI Requirement 9.6.3 – Ensure Management Approves All Media Moved from a Secured Area
PCI Requirement 9.7 – Maintain Strict Control Over the Storage and Accessibility of Media
PCI Requirement 9.7.1 – Properly Maintain Inventory Logs of All Media
PCI Requirement 9.8 – Destroy Media When it is no Longer Needed
PCI Requirement 9.8.1 – Shred Hard-Copy Materials so CHD Cannot be Reconstructed
PCI Requirement 9.8.2 – Render CHD on Electronic Media Unrecoverable
PCI Requirement 9.9 – Protect Devices That Capture Payment Card Data via Direct Physical Interaction
PCI Requirement 9.9.1 – Maintain an Up-To-Date List of Devices
PCI Requirement 9.9.2 – Periodically Inspect Device Surfaces to Detect Tampering or Substitution
PCI Requirement 9.9.3 – Provide Training for Personnel to Be Aware of Attempted Tampering of Devices
Physical Security Responsibilities for AWS
Physical Security Responsibilities for AWS Users
Physical Threats for AWS
SOC 2 Academy: Disposing of Physical Devices
SOC 2 Academy: Physical Security Controls
SOC 2 Academy: Taking Inventory of Physical Devices

Partner with us

Our information security auditors are ready to assist you with your compliance challenges. Schedule an appointment with our certified specialists to get the conversation started!

Connect with a Live Expert