PCI DSS Requirement 9 - Restrict Physical Access to Cardholder Data

Requirement 9 of PCI DSS asks you to control who can physically get to the systems, devices, and paper that hold card data. That means locked and monitored rooms for servers and network gear, badges and escorts for visitors, secure storage and destruction of media like backup drives and printed reports, and regular checks that nobody has tampered with your card terminals. Requirements 7 and 8 control who can log in. Requirement 9 controls who can walk up and touch the hardware.

Which areas does Requirement 9 cover?

PCI DSS talks about three kinds of space: the facility (your whole building), the card data environment, and the sensitive areas that need the tightest control, such as a server room, a network closet, or a room where card data is processed. Cashier areas where only the point-of-sale terminals sit don't count as sensitive areas. If your servers live with a hosting or cloud provider, their data center controls cover much of Requirement 9 for those systems. Check their compliance documents to see which parts they take on, and keep a record of it.

How should access to sensitive areas be controlled?

Requirement 9.2.1 asks for entry controls on the facility, such as locks or badge readers. Requirement 9.2.1.1 says individual access to sensitive areas must be monitored with video cameras, physical access control systems like badge readers, or both. That data must be reviewed, and kept for at least three months unless the law says otherwise. Requirement 9.2.2 says network jacks in public areas must be physically or logically controlled, for example disabled at the switch, so a stranger can't plug a laptop into your network in the lobby. Requirement 9.2.3 restricts physical access to wireless access points, networking gear, and telecom lines.

Who should get physical access, and when does it end?

Only people whose job needs it. Requirement 9.3.1.1 says access to sensitive areas is authorized based on job function and revoked immediately when someone leaves, with keys, badges, and door codes returned or disabled at the same time. A former employee whose badge still opens the server room is exactly the gap this is meant to close.

How should visitors be handled?

Requirement 9.3.2 says visitors must be authorized before they enter areas where card data is processed or kept, escorted the whole time they are there, and given a badge that clearly marks them as visitors and expires. Requirement 9.3.3 says the badge is handed back or deactivated before they leave. Requirement 9.3.4 asks for a visitor log that records each visitor's name, the company they represent, the date and time, and the staff member who authorized access. Keep that log for at least three months unless the law says otherwise. A delivery driver, an IT contractor fixing a printer, and an auditor all count as visitors.

What counts as media, and how is it protected?

Media is anything that holds card data: backup drives, USB sticks, laptops, printed reports, receipts, and forms. Requirement 9.4.1 says it must all be physically secured. Requirement 9.4.1.1 says offline backups must be kept somewhere secure, and that location reviewed at least once every 12 months. Requirement 9.4.2 asks you to classify media by how sensitive its data is. Requirements 9.4.3 and 9.4.4 say media sent off-site goes by secure courier or another method that can be tracked, is logged, and needs management approval. Requirement 9.4.5 asks for an inventory log of electronic media with card data, and 9.4.5.1 asks for an inventory check at least once every 12 months.

How do you destroy media you no longer need?

In a way that means the data can't be put back together. Requirement 9.4.6 says paper with card data must be destroyed when it is no longer needed, by cross-cut shredding, incineration, or pulping, and anything waiting to be destroyed must sit in a locked container. Requirement 9.4.7 says electronic media must be destroyed, or the card data made unrecoverable, when it is no longer needed. Deleting files or reformatting a drive is not enough. Use a secure wipe tool or physically destroy the drive.

How do you protect card terminals from tampering?

Criminals fit skimmers onto real terminals, or swap a terminal for a doctored copy that looks the same. Requirement 9.5.1 asks you to protect the devices that read cards against tampering and substitution. Requirement 9.5.1.1 asks for an up-to-date list of every device, with its make, model, location, and serial number. Requirement 9.5.1.2 asks you to inspect each one regularly for signs of tampering, such as extra attachments, broken seals, odd wiring, or a changed serial number. Since 31 March 2025, Requirement 9.5.1.2.1 asks you to set how often those inspections happen through a targeted risk analysis. Requirement 9.5.1.3 asks for training, so staff check the identity of anyone who claims to be there to repair or replace a terminal, and report anything suspicious.

Can an ASV scan help with Requirement 9?

Not directly. An ASV scan can't check a locked door or a terminal's seal. It covers the other route to the same data: the systems you expose to the internet, which an attacker can reach from anywhere without setting foot in your building. ServerScan is a PCI Approved Scanning Vendor, and our quarterly external scans meet Requirement 11.3.2. The pricing page shows what a plan includes, and Requirement 7 covers the logical side of access control.

Go on to Requirement 10 - Tracking & Monitoring.

Go back to Requirement 8 - Authenticating Access.