What it asks for. Requirement 9 of PCI DSS v4.0 covers physical security for the cardholder data environment. It includes facility entry controls, managing personnel and visitor access, protecting and securely destroying media containing cardholder data, and protecting point of interaction devices, such as card terminals, from tampering and substitution.
In practice. Organisations restrict and monitor physical access to sensitive areas, maintain visitor logs, secure and track media, destroy media when no longer needed and keep an inventory of payment terminals. Staff are trained to inspect devices for tampering and to verify the identity of anyone claiming to service them. Evidence includes access logs, visitor records, media destruction records, device inventories and inspection records.
Common gaps. Terminal inspection is often not performed regularly in retail settings. Paper records containing card data can also be overlooked.