PCI DSS 9.5.1: Know every card-reading device you have, look at them regularly for signs of tampering or swapping, and train the people near them to notice and report it.
PCI DSS v4.0.1 control 9.5.1: the requirement in full, the 1 testing procedure an assessor uses to verify it, and the related controls in section 9.5.
PCIComplianceHubLast updated Last reviewed against PCI DSS v4.0.1
Requirement 9: Restrict Physical Access to Cardholder Data › Section 9.5
POI devices that capture payment card data via direct physical interaction with the payment card form factor are protected from tampering and unauthorized substitution, including the following:
- Maintaining a list of POI devices.
- Periodically inspecting POI devices to look for tampering or unauthorized substitution.
- Training personnel to be aware of suspicious behavior and to report tampering or unauthorized substitution of devices.
Summary
Know every card-reading device you have, look at them regularly for signs of tampering or swapping, and train the people near them to notice and report it.
What the assessor will examine
These are the testing procedures the standard defines for this control. They tell you what evidence to have ready.
| Procedure | |
|---|---|
| 9.5.1 | Examine documented policies and procedures to verify that processes are defined that include all elements specified in this requirement. |
Three obligations in one control, and they are assessed together: the list, the inspections, and the training. The single procedure examines documented policies and procedures covering all three, and the sub-requirements carry the detail: 9.5.1.1 the device list, 9.5.1.2 the inspections, with their frequency and type set by a targeted risk analysis under 9.5.1.2.1, and 9.5.1.3 the training. The applicability notes scope it to deployed POI devices used in card-present transactions, where a card is swiped, tapped or dipped, and exclude components used only for manual key entry and commercial off-the-shelf phones and tablets, though the guidance suggests protecting those too. This is a physical-world control and it fails in physical-world ways: skimming overlays fitted to a terminal, a device swapped for a lookalike, or a technician nobody verified. Face-to-face merchants sometimes assume the outsourcing that took their e-commerce out of scope covers this too. It does not: the device in the shop is theirs.
What to prepare
- The device list: make, model, serial number and location for every POI device.
- Inspection records, dated, saying who looked and what they checked.
- Training material and completion records for staff who work near the devices.
- The procedure for verifying an engineer before letting them touch a terminal.
How to implement it
1. Photograph each device when you install it. The most practical inspection aid is a known-good picture, including the serial number and any seals. Tampering is much easier to see against a reference than from memory.
2. Fix the inspection to a routine that already happens. Opening or closing checks survive; a monthly reminder does not. What matters for the evidence is that the record exists and is dated.
3. Train for the social attack, not only the physical one. The guidance to 9.5.1.3 warns that criminals dress for the part and even post “replacement” devices with instructions to swap them. The training that pays is a rule that nobody touches or swaps a device without verification.
4. Keep the list current when devices move. A device list that does not match what is on the counter turns every inspection record into a question about which device it covered.
Where this commonly fails
- A list with models but no serial numbers, so substitution cannot be detected by inspection.
- Inspections performed but never recorded, which leaves nothing for the assessor to examine.
- Training given to the manager and not to the staff who actually stand at the terminal.
- Unattended or customer-facing devices inspected less often than staffed ones, when they are the easier target.
- Assuming a compliant payment provider covers the physical device the merchant owns and operates.
Related controls
Others in section 9.5:
| Control | What it requires |
|---|---|
| 9.5.1.1 | An up-to-date list of POI devices is maintained… |
| 9.5.1.2 | POI device surfaces are periodically inspected to detect tampering and unauthorized substitution |
| 9.5.1.2.1 | The frequency of periodic POI device inspections and the type of inspections performed… |
| 9.5.1.3 | Training is provided for personnel in POI environments to be aware of attempted tampering… |
Terms
Glossary entries that name this control, each with its own example, limits and sources:
← 9.4.7 · All controls · 9.5.1.1 →
Source
The requirement text and testing procedures above are reproduced from PCI DSS v4.0.1 (June 2024), ©2006-2024 PCI Security Standards Council, LLC. All rights reserved. The commentary is our own.
The official standard is authoritative and also contains the Customized Approach Objective, applicability notes and guidance for this control. Download it from the PCI Security Standards Council document library. PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site. Nothing here is a substitute for advice from a Qualified Security Assessor.