9.3 Is physical access to sensitive controlled for onsite Interview personnel personnel, as follows: Examine access control lists Is access authorized and based on individual job Observe onsite personnel function? Compare lists of terminated Is access revoked immediately upon termination employees to access control lists Upon termination, are all physical access mechanisms, such as keys, access cards, etc., returned or disabled? 9.4 Is visitor identification and access handled as follows: 9.4.1 Are visitors authorized before entering, and escorted at Review policies and procedures all times within, areas where cardholder data is Observe visitor processes processed or maintained? including how access is controlled Interview personnel Observe visitors and badge use Are visitors identified and given a badge or other 9.4.2 Observe badge use of personnel identification that visibly distinguishes the visitors and visitors from onsite personnel? Examine identification Do visitor badges or other identification expire? Observe process Examine identification 9.4.3 Are visitors to surrender the badge or other Observe processes identification before leaving the facility or at the date of Observe visitors leaving facility expiration? 9.4.4 Is a visitor log in use to record physical access to Review policies and procedures the facility as well as for computer rooms and data Examine the visitor log centers where cardholder data is stored or Observe visitor processes transmitted? Examine log retention Does the visitor log contain the visitor’s name, the Review policies and procedures firm represented, and the onsite personnel Examine the visitor log authorizing physical access?
9.3 Is physical access to sensitive controlled for onsite personnel, as follows: Is access authorized and based on individual job function? Is access revoked immediately upon termination Upon termination, are all physical access mechanisms, such as keys, access cards, etc., returned or disabled? Interview personnel Examine access control lists Observe onsite personnel Compare lists of terminated employees to access control lists 9.4 Is visitor identification and access handled as follows: 9.4.1 Are visitors authorized before entering, and escorted at all times within, areas where cardholder data is processed or maintained? Review policies and procedures Observe visitor processes including how access is controlled Interview personnel Observe visitors and badge use 9.4.2 Are visitors identified and given a badge or other identification that visibly distinguishes the visitors from onsite personnel? Observe badge use of personnel and visitors Examine identification Do visitor badges or other identification expire? Observe process Examine identification 9.4.3 Are visitors to surrender the badge or other identification before leaving the facility or at the date of expiration? Observe processes Observe visitors leaving facility 9.4.4 Is a visitor log in use to record physical access to the facility as well as for computer rooms and data centers where cardholder data is stored or transmitted? Review policies and procedures Examine the visitor log Observe visitor processes Examine log retention Does the visitor log contain the visitor’s name, the firm represented, and the onsite personnel authorizing physical access? Review policies and procedures Examine the visitor log
PCI-DSS-v3_2-SAQ-D-for-Chase-Mobile-v1.3.docx