Implement Strong Access Control Measures
9
Restrict Physical Access to Cardholder Data
Physical access to systems containing cardholder data must be controlled through entry controls, visitor management, media handling procedures, and point-of-interaction (POI) device security. This requirement covers data centres, server rooms, and any location where cardholder data is accessible.
Control Intent
Prevent unauthorised physical access to systems that store, process, or transmit cardholder data, and protect media containing cardholder data from unauthorised access, tampering, or theft.
Common Failures
- Inadequate entry controls to server rooms or data centres — tailgating allowed or badge access not enforced
- Visitor logs incomplete or not retained for the required 12-month period
- Media containing cardholder data not securely destroyed — paper shredded without cross-cut, hard drives disposed without degaussing or destruction
- POI devices not regularly inspected for tampering or substitution (skimming devices)
- Backup media containing cardholder data stored in unsecured locations