{"id":614,"date":"2020-04-23T13:38:11","date_gmt":"2020-04-23T13:38:11","guid":{"rendered":"http:\/\/www.pcidssguide.com\/?p=614"},"modified":"2023-10-09T13:50:47","modified_gmt":"2023-10-09T13:50:47","slug":"pci-dss-requirement-9-through-physical-security","status":"publish","type":"post","link":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/","title":{"rendered":"Ensuring Physical Security: PCI DSS Requirement 9"},"content":{"rendered":"\n\n\n\n\n<p>When you hear the word data protection, what&#8217;s the first thing that comes to mind? You can talk about checking firewalls, encryption, and even vulnerabilities. But have you ever thought of locked doors, security badges, or login sheets?<\/p>\n\n\n\n<p>Are you aware that most devices containing sensitive data are stolen in the middle of the day? This is because it&#8217;s easier to steal data when employees are too busy to notice someone leaving the office with a phone, laptop, or server.<\/p>\n\n\n\n<p>Many companies still don&#8217;t know how physical protection will help protect card details. However, there are also a few ways data thieves can gain access by circumventing physical access controls, and most such technical devices do not require them.<\/p>\n\n\n\n<p>Strengthening your physical protection prevents hackers and social engineers from obtaining the information needed to access and steal card data.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What are the PCI DSS Physical Security Requirements?<\/strong><\/h2>\n\n\n\n<p>When you think of a data breach, the idea of \u200b\u200ba hacker somehow getting into a computer or network infrastructure comes to mind. However, not all data security incidents are caused by remote cyberattacks; most of them are caused by physical breaches.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/pci-compliant-data-center-requirements\/\">See Also: PCI Compliant Data Center Requirements<\/a><\/strong><\/p>\n\n\n\n<p>Therefore, it is not surprising that the Payment Card Industry Data Security Standard (PCI DSS) outlines specific guidelines to physically secure cardholder data environments (CDE).<\/p>\n\n\n\n<p>With unauthorized access, criminals, fraudsters, and fraudulent employees can quickly access, remove, edit, or tamper with a device that touches or stores cardholder data (CHD) and payment information.<\/p>\n\n\n\n<p>For example, fraudsters are increasingly applying &#8220;skimming&#8221; devices to compromise credit and debit cards at ATMs and gas station pump terminals. While the transition to EMV chip cards is designed to alleviate this growing problem, the risks remain.<\/p>\n\n\n\n<p> <strong><a href=\"https:\/\/pcidssguide.com\/data-center-audit-checklist\/\">See Also: Data Center Audit Checklist<\/a><\/strong> <\/p>\n\n\n\n<p>Complicating the situation is that not all card data is stored electronically. Often, businesses keep hard copies of customer payment card data and receipts. If they fall into the wrong hands with these materials due to PCI non-compliance, businesses will face heavy penalties, lose consumer trust, and damage their credibility.<\/p>\n\n\n\n<p><a href=\"https:\/\/pcidssguide.com\/pci-dss-requirement-9\/\">PCI DSS Requirement 9<\/a> is purely physically dedicated to stopping cardholder data theft. Criminals often try to access cardholder data by physically stealing hardware or paper receipts that contain SAD data. Likewise, tampering or modifying legitimate card reading devices is a common attack technique used by attackers.<\/p>\n\n\n\n<p>PCI DSS Requirement 9 was created with ten sub-requirements to help protect cardholder data from a physical perspective. Each of the sub-requirements is dedicated to a different aspect of physical security and includes detailed descriptions of how to complete the tasks that make up the fundamental requirement:<\/p>\n\n\n\n<ul>\n<li>To restrict and track physical access to devices in the cardholder data area, use sufficient facility entry controls.<\/li>\n\n\n\n<li>Develop procedures to easily distinguish onsite staff and visitors, particularly in areas where cardholder data is accessible.<\/li>\n\n\n\n<li>Give each user a unique identity. Each user with access to the Cardholder Data Environment must have a unique ID. In this way, you can track each action up to a specific individual.<\/li>\n\n\n\n<li>Before accessing areas where cardholder data is processed or stored, make sure all visitors are allowed.<\/li>\n\n\n\n<li>Tokens or cards that identify visitors as onsite personnel must be delivered before leaving the facility or on the expiration date.<\/li>\n\n\n\n<li>Use a visitor log to keep a physical audit trail of visitor information and activities, including visitor names, companies, and onsite staff who allow physical access.<\/li>\n\n\n\n<li>Keep the visitor log for at least three months, unless otherwise restricted by law.<\/li>\n\n\n\n<li>Store media backups in a safe place, preferably offsite.<\/li>\n\n\n\n<li>Physically protect all media.<\/li>\n\n\n\n<li>Maintain tight control over the internal or external distribution of all types of media. Classify the media so that the sensitivity of the data can be determined.<\/li>\n\n\n\n<li>Make sure management approves all media moved from a secure area, mainly when media is distributed to individuals.<\/li>\n\n\n\n<li>Maintain strict control over media storage and accessibility.<\/li>\n\n\n\n<li>Dispose of media when it is no longer necessary for commercial or legal reasons.<\/li>\n<\/ul>\n\n\n\n<p>PCI DSS requirement 9 also covers physical security for media containing SAD, such as CDs \/ DVDs, hard drives, USB keys, and electronic media such as tape backup. Sensitive areas requiring increased physical security to protect SAD include data centers, server rooms, call centers, and network hardware locations. However, it does not have public areas such as in-store checkout areas.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>PCI DSS Physical Security Requirements Tips<\/strong><\/h2>\n\n\n\n<p>PCI DSS Requirement 9 includes all physical security checks. Here are a few tips for ensuring that PCI DSS physical security requirements provide adequate protection against card data loss and ensure that your physical security is PCI compliant.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1. Create and Maintain Your Device Inventory.<\/strong><\/h3>\n\n\n\n<p>Many companies use mobile devices as part of their transactions. While useful, mobile device use also comes with some security issues. Device theft, including laptops and servers, is also a cause of data breaches.<\/p>\n\n\n\n<p>If you don&#8217;t know where your devices are, you cannot protect cardholder data either. Start protecting cardholder data by first creating an inventory of all devices that store, process, transmit sensitive information or that could impact security.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/how-to-protect-your-pos-system-from-pos-malware\/\">See Also: How to Protect Your POS System from POS Malware<\/a><\/strong><\/p>\n\n\n\n<p>List the programs running on these systems, including version information, so that you can be aware of known vulnerabilities. Determine physical locations and who can access these systems.<\/p>\n\n\n\n<p>It&#8217;s easy to recognize servers, firewalls, workstations, and laptops, but don&#8217;t forget about other resources that need to be physically secured, such as:<\/p>\n\n\n\n<ul>\n<li>Wireless access points<\/li>\n\n\n\n<li>Network jacks<\/li>\n\n\n\n<li>Telecommunication lines<\/li>\n\n\n\n<li>External hard drives<\/li>\n\n\n\n<li>Backups<\/li>\n\n\n\n<li>Paper records<\/li>\n<\/ul>\n\n\n\n<p>Remember, an inventory is just a snapshot. Set up a system to update the list as things change, and monitor equipment movement and removable media inside and outside your space.<\/p>\n\n\n\n<p>Ensure you have a detailed list of devices that can hold or add data to your card details. Your company will know where these machines are, who is running them, and whether they have left your company settings.<\/p>\n\n\n\n<p>The inventory will help you keep track of all the devices you use. If attackers steal something, the inventory list you keep will help you easily identify the stolen computer, where it is, what data was stolen, and what steps can be taken.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2. Provide Restricted Access to Critical Areas or Facilities.<\/strong><\/h3>\n\n\n\n<p>Rooms with card information should only be accessible by employees who need it.<\/p>\n\n\n\n<p>Make sure you only give your employees the amount of access they need. For example, your marketing boss doesn&#8217;t need to have access to card data. Most data is stored in a data center, and you need to trust your data center service provider before delivering all your data.<\/p>\n\n\n\n<p>When you know which systems to protect, set up PCI DSS Requirement 9 controls that restrict access to them, such as card readers and keylocks. Employee access must be allowed and required for the employee&#8217;s job function. When visitors are expected to access sensitive areas, make sure they are permitted by an employee and accompanied at all times.<\/p>\n\n\n\n<p>It is essential to have a way to recognize and distinguish employees and visitors, such as badges. You will need a way for anyone accessing a sensitive area, such as video cameras and access logs, to follow and log in.<\/p>\n\n\n\n<p>Ensure you find a way to disable access when a visitor&#8217;s stay ends or an employee is fired. Make sure all physical access devices such as keys and access cards are returned or disabled.<\/p>\n\n\n\n<p>Do not hide sensitive information such as payment card details in the open. For example, event planning firms and catering suppliers can use paper forms containing customers&#8217; credit card details. The card is usually paid at such companies, and the paper order form is destroyed until the end of the event.<\/p>\n\n\n\n<p>If your company collects credit card information similarly, the papers must be structured appropriately to keep sensitive data separate from the order information.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3. Establish Your Physical Security Policies.<\/strong><\/h3>\n\n\n\n<p>It would be better if you comprehensively defined your corporate and physical protection policies. Both parties with access to cardholder data must be aware of these documents and be adequately trained to comply with these policies.<\/p>\n\n\n\n<p>You will need to develop a set of policies to manage physical security for employees. Doing so will protect against intentional or accidental theft of data. Things to consider in your policies include the following:<\/p>\n\n\n\n<ul>\n<li>When the doors are locked<\/li>\n\n\n\n<li>Who has which access authorization?<\/li>\n\n\n\n<li>Which devices will always stay in place?<\/li>\n\n\n\n<li>Who inspects the security application?<\/li>\n\n\n\n<li>Physical access to hardware and network infrastructure for CDE servers<\/li>\n\n\n\n<li>Password change policy<\/li>\n\n\n\n<li>How to report lost and stolen access cards or badges<\/li>\n\n\n\n<li>Visitor access procedures<\/li>\n<\/ul>\n\n\n\n<p>Documenting these policies and procedures is very important because putting them on paper explains the concerns workers may have and minimizes liability in the event of a violation. You should also periodically renew these policies.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>4. Train Your Employees on Physical Security Policies.<\/strong><\/h3>\n\n\n\n<p>Policies and procedures alone are useless for your company if your staff does not comply with security policies. One of the leading causes of many data breaches is human error. It is enough for an employee to forget to lock a door or a locker in the data center, for an unauthorized person to steal devices or intercept data in a restricted area.<\/p>\n\n\n\n<p>Make sure you train your staff on physical safety. Give examples of correct and incorrect policies and procedures. Ensure employees understand the costs and liabilities that may arise if they fail to comply with company policies.<\/p>\n\n\n\n<p>It is recommended that employees receive training every three months, if not monthly. You should also update the training content when your policies change.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>5. Don&#8217;t Forget The Small Details.<\/strong><\/h3>\n\n\n\n<p>It&#8217;s good to make sure your doors are locked at night and everything is safe, but what about the daytime? Contrary to popular belief, a lot of data theft occurs in the middle of working hours, with social engineering attacks. Consider the access privileges that the doorman and delivery staff have. Accessing data by pretending to be an employee will be very simple with a social engineering attack.<\/p>\n\n\n\n<p>Sometimes attackers are very good at accessing unauthorized areas unnoticed with social engineering attacks, mostly because workers ignore smaller security details. No matter how sweet and innocent someone is, you should stick to their data protection policies.<\/p>\n\n\n\n<p>Smaller security details mustn&#8217;t be left out. Setting up computer-based privacy controls, installing blinds in rooms with sensitive data, and recording who enters and leaves the company will provide vital protection to secure card data.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>6. Secure Your POS Devices.<\/strong><\/h3>\n\n\n\n<p>Attackers who can access POS devices can manipulate the computers and terminals that read the card and steal card data. Remember to keep an inventory of POS machines and regularly check for signs of misuse.<\/p>\n\n\n\n<p>If your company has card reading POS systems used in card transactions, PCI DSS provides unique security requirements to protect them:<\/p>\n\n\n\n<ul>\n<li>Create an up-to-date list of all devices, including physical location, serial numbers, and make \/ model.<\/li>\n\n\n\n<li>Inspect devices periodically to ensure they have not been tampered with. Make sure serial numbers match and seals are not broken.<\/li>\n\n\n\n<li>Train relevant employees regarding the security of POS devices.<\/li>\n<\/ul>\n\n\n\n<p>To help employees conduct successful software reviews, it is essential to create instructions, identify fraudulent behavior around payment systems, and understand what third parties will do when working on the network.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>7. Securely Delete Credit Card Information.<\/strong><\/h3>\n\n\n\n<p>The best way to protect cardholder data is to keep them no longer than necessary. Create a schedule to check that media containing cardholder data should be destroyed safely when it is no longer needed.<\/p>\n\n\n\n<p>Crumble, pulp, or burn the printed copies. Physically wipe, demagnetize or destroy electronic content. Also, lock the storage containers used for shredded or discarded items so that criminals cannot take them back for fraudulent use.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Closing Considerations on PCI DSS Physical Security Requirements<\/strong><\/h2>\n\n\n\n<p>Credit cards contain a large amount of sensitive data about the cardholder. A person&#8217;s life can be ruined if the data gets into the wrong hands. Now imagine the company has millions of credit card storages containing card information. If a phishing scam or attack accesses the database remotely, all payment card records can be compromised in the blink of an eye.<\/p>\n\n\n\n<p> <strong><a href=\"https:\/\/pcidssguide.com\/what-are-pci-dss-backup-requirements\/\">See Also: What are PCI DSS Backup Requirements<\/a><\/strong> <\/p>\n\n\n\n<p>At all times, companies are required to be 100% compliant with PCI DSS and maintain compliance year after year. To secure your CDE and your organization from data breaches, it would be better if you had the most up-to-date cybersecurity plans and trained employees.<\/p>\n\n\n\n<p>When it comes to protecting your CDE and data in transit, you need to maintain your continued compliance with all PCI DSS Requirement 9 and sub-requirements as well as 11 other PCI DSS requirements to help you reduce PCI coverage and maintain a healthy cybersecurity stance.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>PCI DSS Requirement 9 includes all physical security aspects. Here are a few tips for ensuring your physical security complies with PCI.<\/p>\n","protected":false},"author":1,"featured_media":615,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[31,42],"tags":[113],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Ensuring Physical Security: PCI DSS Requirement 9 - PCI DSS GUIDE<\/title>\n<meta name=\"description\" content=\"PCI DSS Requirement 9 was created with ten sub-requirements to help protect cardholder data from a physical security perspective.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ensuring Physical Security: PCI DSS Requirement 9 - PCI DSS GUIDE\" \/>\n<meta property=\"og:description\" content=\"PCI DSS Requirement 9 was created with ten sub-requirements to help protect cardholder data from a physical security perspective.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/\" \/>\n<meta property=\"og:site_name\" content=\"PCI DSS GUIDE\" \/>\n<meta property=\"article:published_time\" content=\"2020-04-23T13:38:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-10-09T13:50:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-physical-security-requirements.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1281\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Surkay Baykara\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Surkay Baykara\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/\"},\"author\":{\"name\":\"Surkay Baykara\",\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"headline\":\"Ensuring Physical Security: PCI DSS Requirement 9\",\"datePublished\":\"2020-04-23T13:38:11+00:00\",\"dateModified\":\"2023-10-09T13:50:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/\"},\"wordCount\":2129,\"publisher\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"image\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-physical-security-requirements.jpg\",\"keywords\":[\"physical security\"],\"articleSection\":[\"PCI DSS Requirement 9\",\"Physical Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/\",\"url\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/\",\"name\":\"Ensuring Physical Security: PCI DSS Requirement 9 - PCI DSS GUIDE\",\"isPartOf\":{\"@id\":\"https:\/\/pcidssguide.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-physical-security-requirements.jpg\",\"datePublished\":\"2020-04-23T13:38:11+00:00\",\"dateModified\":\"2023-10-09T13:50:47+00:00\",\"description\":\"PCI DSS Requirement 9 was created with ten sub-requirements to help protect cardholder data from a physical security perspective.\",\"breadcrumb\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#primaryimage\",\"url\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-physical-security-requirements.jpg\",\"contentUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-physical-security-requirements.jpg\",\"width\":1920,\"height\":1281,\"caption\":\"PCI DSS Physical Security Requirements\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/pcidssguide.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ensuring Physical Security: PCI DSS Requirement 9\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/pcidssguide.com\/#website\",\"url\":\"https:\/\/pcidssguide.com\/\",\"name\":\"PCI DSS GUIDE\",\"description\":\"PCI Compliance Guide For All Business\",\"publisher\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/pcidssguide.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\",\"name\":\"Surkay Baykara\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g\",\"caption\":\"Surkay Baykara\"},\"logo\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/\"},\"description\":\"A passionate Senior Information Security Consultant working at Cyberwise. Over the past 15+ years my professional career has included several positions beginning as a developer and IT administrator, working my way up to a senior Technical Performance Consultant before joining Biznet back in 2015. I had several different roles at Cyberwise, including Penetration Tester and PCI DSS QSA. In my job as a QSA, I found my passion and worked closely with the Audit and Compliance team. I've been working inside InfoSec for over 15 years, coming from a highly technical background. I have earned several certifications during my professional career including; CEH, CISA, CISSP, and PCI QSA.\",\"sameAs\":[\"https:\/\/www.pcidssguide.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ensuring Physical Security: PCI DSS Requirement 9 - PCI DSS GUIDE","description":"PCI DSS Requirement 9 was created with ten sub-requirements to help protect cardholder data from a physical security perspective.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/","og_locale":"en_US","og_type":"article","og_title":"Ensuring Physical Security: PCI DSS Requirement 9 - PCI DSS GUIDE","og_description":"PCI DSS Requirement 9 was created with ten sub-requirements to help protect cardholder data from a physical security perspective.","og_url":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/","og_site_name":"PCI DSS GUIDE","article_published_time":"2020-04-23T13:38:11+00:00","article_modified_time":"2023-10-09T13:50:47+00:00","og_image":[{"width":1920,"height":1281,"url":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-physical-security-requirements.jpg","type":"image\/jpeg"}],"author":"Surkay Baykara","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Surkay Baykara","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#article","isPartOf":{"@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/"},"author":{"name":"Surkay Baykara","@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"headline":"Ensuring Physical Security: PCI DSS Requirement 9","datePublished":"2020-04-23T13:38:11+00:00","dateModified":"2023-10-09T13:50:47+00:00","mainEntityOfPage":{"@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/"},"wordCount":2129,"publisher":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"image":{"@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#primaryimage"},"thumbnailUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-physical-security-requirements.jpg","keywords":["physical security"],"articleSection":["PCI DSS Requirement 9","Physical Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/","url":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/","name":"Ensuring Physical Security: PCI DSS Requirement 9 - PCI DSS GUIDE","isPartOf":{"@id":"https:\/\/pcidssguide.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#primaryimage"},"image":{"@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#primaryimage"},"thumbnailUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-physical-security-requirements.jpg","datePublished":"2020-04-23T13:38:11+00:00","dateModified":"2023-10-09T13:50:47+00:00","description":"PCI DSS Requirement 9 was created with ten sub-requirements to help protect cardholder data from a physical security perspective.","breadcrumb":{"@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#primaryimage","url":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-physical-security-requirements.jpg","contentUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-physical-security-requirements.jpg","width":1920,"height":1281,"caption":"PCI DSS Physical Security Requirements"},{"@type":"BreadcrumbList","@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-9-through-physical-security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/pcidssguide.com\/"},{"@type":"ListItem","position":2,"name":"Ensuring Physical Security: PCI DSS Requirement 9"}]},{"@type":"WebSite","@id":"https:\/\/pcidssguide.com\/#website","url":"https:\/\/pcidssguide.com\/","name":"PCI DSS GUIDE","description":"PCI Compliance Guide For All Business","publisher":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/pcidssguide.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741","name":"Surkay Baykara","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g","caption":"Surkay Baykara"},"logo":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/"},"description":"A passionate Senior Information Security Consultant working at Cyberwise. Over the past 15+ years my professional career has included several positions beginning as a developer and IT administrator, working my way up to a senior Technical Performance Consultant before joining Biznet back in 2015. I had several different roles at Cyberwise, including Penetration Tester and PCI DSS QSA. In my job as a QSA, I found my passion and worked closely with the Audit and Compliance team. I've been working inside InfoSec for over 15 years, coming from a highly technical background. I have earned several certifications during my professional career including; CEH, CISA, CISSP, and PCI QSA.","sameAs":["https:\/\/www.pcidssguide.com"]}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/614"}],"collection":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/comments?post=614"}],"version-history":[{"count":2,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/614\/revisions"}],"predecessor-version":[{"id":2245,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/614\/revisions\/2245"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/media\/615"}],"wp:attachment":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/media?parent=614"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/categories?post=614"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/tags?post=614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}