[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:pci-dss\u002Frequirement-9":3},{"item":4,"lessons":16,"controls":54,"related":81},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"pci-dss","requirement-9","Requirement 9","Requirement 9: Restrict Physical Access to Cardholder Data",9,"PCI Security Standards Council","**What it asks for.** Requirement 9 of PCI DSS v4.0 covers physical security for the cardholder data environment. It includes facility entry controls, managing personnel and visitor access, protecting and securely destroying media containing cardholder data, and protecting point of interaction devices, such as card terminals, from tampering and substitution.\n\n**In practice.** Organisations restrict and monitor physical access to sensitive areas, maintain visitor logs, secure and track media, destroy media when no longer needed and keep an inventory of payment terminals. Staff are trained to inspect devices for tampering and to verify the identity of anyone claiming to service them. Evidence includes access logs, visitor records, media destruction records, device inventories and inspection records.\n\n**Common gaps.** Terminal inspection is often not performed regularly in retail settings. Paper records containing card data can also be overlooked.",null,"https:\u002F\u002Fwww.pcisecuritystandards.org\u002Fstandards\u002Fpci-dss\u002F","Read about PCI DSS","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50],{"slug":19,"title":20,"published_at":21},"atm-jackpotting-ring-exposes-physical-cyber-security-gaps-in-banking-infrastructure","ATM Jackpotting Ring Exposes Physical & Cyber Security Gaps in Banking Infrastructure","2026-10-08T20:20:59.635+00:00",{"slug":23,"title":24,"published_at":25},"ploutus-atm-malware-developer-arrested-lessons-for-physical-logical-atm-security","Ploutus ATM Malware Developer Arrested — Lessons for Physical & Logical ATM Security","2026-10-06T14:21:58.654+00:00",{"slug":27,"title":28,"published_at":29},"ploutus-atm-jackpotting-malware-exposes-critical-physical-and-logical-atm-security-gaps","Ploutus ATM Jackpotting Malware Exposes Critical Physical and Logical ATM Security Gaps","2026-10-05T14:20:40.141+00:00",{"slug":31,"title":32,"published_at":33},"atm-jackpotting-malware-exposes-critical-physical-and-cyber-security-gaps","ATM Jackpotting Malware Exposes Critical Physical and Cyber Security Gaps","2026-10-01T12:20:33.379+00:00",{"slug":35,"title":36,"published_at":37},"traditional-credit-card-fraud-remains-a-persistent-threat","Traditional Credit Card Fraud Remains a Persistent Threat","2026-09-26T20:22:11.622+00:00",{"slug":39,"title":40,"published_at":41},"atm-jackpotting-scheme-exposes-physical-and-logical-security-gaps","ATM Jackpotting Scheme Exposes Physical and Logical Security Gaps","2026-09-01T12:20:57.8+00:00",{"slug":43,"title":44,"published_at":45},"atm-jackpotting-gang-exploits-unpatched-machines-across-the-us","ATM Jackpotting Gang Exploits Unpatched Machines Across the US","2026-09-01T10:20:37.378+00:00",{"slug":47,"title":48,"published_at":49},"atm-jackpotting-scheme-nets-record-8-year-sentence","ATM Jackpotting Scheme Nets Record 8-Year Sentence","2026-08-24T12:20:34.871+00:00",{"slug":51,"title":52,"published_at":53},"nfc-relay-attack-tool-threatens-payment-infrastructure","NFC Relay Attack Tool Threatens Payment Infrastructure","2026-04-03T23:07:45.149+00:00",[55,60,65,69,73,77],{"slug":56,"name":57,"problem":58,"stories":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",3,{"slug":61,"name":62,"problem":63,"stories":64},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,{"slug":66,"name":67,"problem":68,"stories":64},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":70,"name":71,"problem":72,"stories":64},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":74,"name":75,"problem":76,"stories":64},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":78,"name":79,"problem":80,"stories":64},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[82,88,93,98,102,106,111,115],{"family":83,"item":84,"code":85,"title":86,"together":87},"cis","13","Control 13","Network Monitoring and Defense",7,{"family":89,"item":90,"code":91,"title":92,"together":87},"nist-800-53","ac-3","AC-3","Access Enforcement",{"family":89,"item":94,"code":95,"title":96,"together":97},"au-6","AU-6","Audit Record Review, Analysis, and Reporting",5,{"family":83,"item":99,"code":100,"title":101,"together":97},"2","Control 2","Inventory and Control of Software Assets",{"family":89,"item":103,"code":104,"title":105,"together":97},"si-3","SI-3","Malicious Code Protection",{"family":89,"item":107,"code":108,"title":109,"together":110},"pe-3","PE-3","Physical Access Control",4,{"family":83,"item":112,"code":113,"title":114,"together":110},"6","Control 6","Access Control Management",{"family":116,"item":117,"code":118,"title":118,"together":110},"itil","overview","ITIL"]