9.4 Is visitor identification and access handled as follows: 9.4.1 Are visitors authorized before entering, and escorted at all Review policies and procedures times within, areas where cardholder data is processed or Observe visitor processes maintained? including how access is controlled Interview personnel Observe visitors and badge use Are visitors identified and given a badge or other 9.4.2 Observe badge use of personnel identification that visibly distinguishes the visitors from and visitors onsite personnel? Examine identification Do visitor badges or other identification expire? Observe process Examine identification 9.4.3 Are visitors asked to surrender the badge or other Observe processes identification before leaving the facility or at the date of Observe visitors leaving facility expiration? 9.4.4 Is a visitor log in use to record physical access to the Review policies and procedures facility as well as for computer and data centers Examine the visitor log where cardholder data is stored or transmitted? Observe visitor processes Examine log retention Does the visitor log contain the visitor’s name, the Review policies and procedures firm represented, and the onsite personnel Examine the visitor log authorizing physical access? Is the visitor log retained for at least three months? Review policies and procedures Examine visitor log retention 9.5 Are all media physically secured (including but not limited Review policies and procedures for to computers, removable electronic media, paper physically securing media receipts, paper reports, and faxes)? Interview personnel For purposes of Requirement 9, refers to all paper and electronic media containing cardholder data.
9.4 Is visitor identification and access handled as follows: 9.4.1 Are visitors authorized before entering, and escorted at all times within, areas where cardholder data is processed or maintained? Review policies and procedures Observe visitor processes including how access is controlled Interview personnel Observe visitors and badge use 9.4.2 Are visitors identified and given a badge or other identification that visibly distinguishes the visitors from onsite personnel? Observe badge use of personnel and visitors Examine identification Do visitor badges or other identification expire? Observe process Examine identification 9.4.3 Are visitors asked to surrender the badge or other identification before leaving the facility or at the date of expiration? Observe processes Observe visitors leaving facility 9.4.4 Is a visitor log in use to record physical access to the facility as well as for computer and data centers where cardholder data is stored or transmitted? Review policies and procedures Examine the visitor log Observe visitor processes Examine log retention Does the visitor log contain the visitor’s name, the firm represented, and the onsite personnel authorizing physical access? Review policies and procedures Examine the visitor log Is the visitor log retained for at least three months? Review policies and procedures Examine visitor log retention 9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing media Interview personnel