9.3 Physical access for personnel and visitors is authorised and managed
How to meet it
Authorise personnel access and log/escort visitors.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 9.3, in plain English.
9.3.1Procedures authorize and manage personnel physical access to the CDE, including revoking access on termination.
9.3.1.1Access to sensitive areas is by job function, revoked on termination, with keys and cards returned or disabled.
9.3.2Procedures authorize and manage visitor access, including escorting visitors and giving expiring badges.
9.3.3Visitor badges are surrendered or deactivated before leaving or when they expire.
9.3.4Visitor logs record name, organization, date/time, authorizing person, and are kept at least three months.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Physical and environmental security policyUse for ISO 27001 A.7.1 to A.7.14, SOC 2 Security, and PCI DSS requirement 9 physical access controls.Clear desk and clear screen policyUse for ISO 27001 A.7.7, physical protection of papers and screens, printing controls, and office and visitor area practices.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.
Open the control-to-policy map← 9.2 Physical access controls manage entry into facilities and systems9.4 Media with cardholder data is securely stored, accessed, distributed and destroyed →
Back to Requirement 9, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.