Do policies and procedures require that personnel Review policies and procedures are trained to be aware of suspicious behavior and to report tampering or substitution of devices? Does the list of devices include the following? Examine the list of devices 9.9.1 Make, model of device Location of device (for example, the address of the site or facility where the device is located) Device serial number or other method of unique identification Is the list accurate and up to date? Observe device locations and compare to list Is the list of devices updated when devices are Interview personnel relocated, decommissioned, etc.? Are device surfaces periodically inspected to Interview personnel 9.9.2 detect tampering (for example, addition of card Observe inspection processes and skimmers to devices), or substitution (for example, compare to defined processes by checking the serial number or other device characteristics to verify it has not been swapped with a fraudulent device) as follows? Note: Examples of signs that a device might have been tampered with or substituted include unexpected attachments or cables plugged into the device, missing or changed security labels, broken or differently colored casing, or changes to the serial number or other external markings. Are personnel are of procedures for inspecting Interview personnel devices? 9.9.3 Are personnel trained to be aware of attempted tampering or replacement of devices, to include the following?
Do policies and procedures require that personnel are trained to be aware of suspicious behavior and to report tampering or substitution of devices? Review policies and procedures 9.9.1 Does the list of devices include the following? Make, model of device Location of device (for example, the address of the site or facility where the device is located) Device serial number or other method of unique identification Examine the list of devices Is the list accurate and up to date? Observe device locations and compare to list Is the list of devices updated when devices are relocated, decommissioned, etc.? Interview personnel 9.9.2 Are device surfaces periodically inspected to detect tampering (for example, addition of card skimmers to devices), or substitution (for example, by checking the serial number or other device characteristics to verify it has not been swapped with a fraudulent device) as follows? Note: Examples of signs that a device might have been tampered with or substituted include unexpected attachments or cables plugged into the device, missing or changed security labels, broken or differently colored casing, or changes to the serial number or other external markings. Interview personnel Observe inspection processes and compare to defined processes Are personnel are of procedures for inspecting devices? Interview personnel 9.9.3 Are personnel trained to be aware of attempted tampering or replacement of devices, to include the following?