9.1.3 Is physical access to wireless access points, gateways, Review policies and procedures handheld devices, networking/communications Interview personnel hardware, and telecommunication lines restricted? Observe devices Are procedures developed to easily distinguish 9.2 Review policies and procedures between onsite personnel and visitors, which Interview personnel include: Observe identification methods Identifying onsite personnel and visitors (for (e.g. badges) example, assigning badges), Observe visitor processes Changing access requirements, and Revoking terminated onsite personnel and expired visitor identification (such as ID badges) For the purposes of Requirement 9, personnel” “onsite refers to full-time and part-time employees, temporary employees, contractors and consultants who are physically present on the entity’s premises. A “visitor” refers to a vendor, guest of any onsite personnel, service workers, or anyone who needs to enter the facility for a short duration, usually not more than one day. Do identification methods (such as ID badges) Observe identification methods clearly identify visitors and easily distinguish between onsite personnel and visitors? Is access to the badge system limited to authorized Observe physical controls and personnel? access controls for the badge system
9.1.3 Is physical access to wireless access points, gateways, handheld devices, networking/communications hardware, and telecommunication lines restricted? Review policies and procedures Interview personnel Observe devices 9.2 Are procedures developed to easily distinguish between onsite personnel and visitors, which include: Identifying onsite personnel and visitors (for example, assigning badges), Changing access requirements, and Revoking terminated onsite personnel and expired visitor identification (such as ID badges) For the purposes of Requirement 9, “onsite personnel” refers to full-time and part-time employees, temporary employees, contractors and consultants who are physically present on the entity’s premises. A “visitor” refers to a vendor, guest of any onsite personnel, service workers, or anyone who needs to enter the facility for a short duration, usually not more than one day. Review policies and procedures Interview personnel Observe identification methods (e.g. badges) Observe visitor processes Do identification methods (such as ID badges) clearly identify visitors and easily distinguish between onsite personnel and visitors? Observe identification methods Is access to the badge system limited to authorized personnel? Observe physical controls and access controls for the badge system
PCI-DSS-v3_2-SAQ-D_Merchant.docx