9.4 Is visitor identification and access handled as follows: 9.4.1 Are visitors authorized before entering, and escorted at Review policies and procedures all times within, areas where cardholder data is Observe visitor processes processed or maintained? including how access is controlled Interview personnel Observe visitors and use Are visitors identified and given a badge or other 9.4.2 Observe badge use of personnel identification that visibly distinguishes the visitors and visitors from onsite personnel? Examine identification Do visitor badges or identification expire? Observe process Examine identification 9.4.3 Are visitors asked to surrender the badge or other Observe processes identification before leaving the facility or at the date of Observe visitors leaving facility expiration? 9.4.4 Is a visitor log in use to record physical access to Review policies and procedures the facility as well as for computer rooms and data Examine the visitor log centers where cardholder data is stored or Observe visitor processes transmitted? Examine log retention Does the visitor log contain the visitor’s name, the Review policies and procedures firm represented, and the onsite personnel Examine the visitor log authorizing physical access? Is the visitor log retained for at least three months? Review policies and procedures Examine visitor log retention 9.5 Are all media physically secured (including but not Review policies and procedures limited to computers, removable electronic media, paper for physically securing receipts, paper reports, and faxes)? Interview personnel For purposes of Requirement 9, refers to all “media” paper and electronic media containing cardholder data.
9.4 Is visitor identification and access handled as follows: 9.4.1 Are visitors authorized before entering, and escorted at all times within, areas where cardholder data is processed or maintained? Review policies and procedures Observe visitor processes including how access is controlled Interview personnel Observe visitors and use 9.4.2 Are visitors identified and given a badge or other identification that visibly distinguishes the visitors from onsite personnel? Observe badge use of personnel and visitors Examine identification Do visitor badges or identification expire? Observe process Examine identification 9.4.3 Are visitors asked to surrender the badge or other identification before leaving the facility or at the date of expiration? Observe processes Observe visitors leaving facility 9.4.4 Is a visitor log in use to record physical access to the facility as well as for computer rooms and data centers where cardholder data is stored or transmitted? Review policies and procedures Examine the visitor log Observe visitor processes Examine log retention Does the visitor log contain the visitor’s name, the firm represented, and the onsite personnel authorizing physical access? Review policies and procedures Examine the visitor log Is the visitor log retained for at least three months? Review policies and procedures Examine visitor log retention 9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, “media” refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing Interview personnel
PCI-DSS-v3_2-SAQ-D_Merchant-rev1_1.docx