Requirement 9: Restrict physical access to cardholder data Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Not Yes CCW No N/A Tested 9.1 Are appropriate facility entry controls in place to limit Observe physical access controls and monitor physical access to systems in the Observe personnel cardholder data environment? Are either cameras or access-control 9.1.1 Review policies and procedures mechanisms (or both) in place to monitor individual Observe physical monitoring physical access to sensitive areas? mechanisms Note: areas” refers to any data center, server “Sensitive Observe security features room, or any area that houses systems that store, process, or transmit cardholder data. This excludes public-facing areas where only point-of-sale terminals are present such as the cashier areas in a retail store. Are either video cameras or access-control Observe processes mechanisms (or both) protected from tampering or Interview personnel disabling? Is data collected from video cameras and/or access Review policies and procedures control mechanisms reviewed and correlated with Interview security personnel other entries? Is data collected from video cameras and/or access Review data retention processes control mechanisms stored for at least three months Observe data storage unless otherwise restricted by law? Interview security personnel 9.1.2 Are physical and/or logical controls in place to restrict Review policies and procedures access to publicly accessible network jacks? Interview personnel For example, network jacks located in public areas and Observe locations areas accessible to visitors could be disabled and only enabled when network access is explicitly authorized. Alternatively, processes could be implemented to ensure that visitors are escorted at all times in areas with active network jacks.
Requirement 9: Restrict physical access to cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 9.1 Are appropriate facility entry controls in place to limit and monitor physical access to systems in the cardholder data environment? Observe physical access controls Observe personnel 9.1.1 Are either cameras or access-control mechanisms (or both) in place to monitor individual physical access to sensitive areas? Note: “Sensitive areas” refers to any data center, server room, or any area that houses systems that store, process, or transmit cardholder data. This excludes public-facing areas where only point-of-sale terminals are present such as the cashier areas in a retail store. Review policies and procedures Observe physical monitoring mechanisms Observe security features Are either video cameras or access-control mechanisms (or both) protected from tampering or disabling? Observe processes Interview personnel Is data collected from video cameras and/or access control mechanisms reviewed and correlated with other entries? Review policies and procedures Interview security personnel Is data collected from video cameras and/or access control mechanisms stored for at least three months unless otherwise restricted by law? Review data retention processes Observe data storage Interview security personnel 9.1.2 Are physical and/or logical controls in place to restrict access to publicly accessible network jacks? For example, network jacks located in public areas and areas accessible to visitors could be disabled and only enabled when network access is explicitly authorized. Alternatively, processes could be implemented to ensure that visitors are escorted at all times in areas with active network jacks. Review policies and procedures Interview personnel Observe locations
PCI-DSS-v3_2-SAQ-D-for-Chase-Mobile-v1.3.docx