Physical Access Control
PCIComplianceHubLast updated
The mechanisms that let only authorised people into a physical space: badge readers, locks, guards, video, and the procedures behind them. It is the physical counterpart of logical access control, and Requirement 9 is built on it.
Applies to. Every facility that houses in-scope systems, media or point-of-interaction devices, and especially the sensitive areas within them.
Example. A server room opens to a badge, the badge is issued only to personnel whose role needs it, the reader logs every entry, and the log is kept for at least three months (9.2.1.1). A visitor is badged differently, escorted, and signed in and out (9.3.2, 9.3.3).
Limits. 9.2.1 requires appropriate controls for the facility and 9.2.1.1 requires sensitive areas to be monitored, with video or access control mechanisms or both, and the data reviewed and retained. Restricting console access in sensitive areas (9.2.4) and network jacks and wireless access points (9.2.2, 9.2.3) are part of the same control set. Physical access control is often the whole of Requirement 9 that a cloud-hosted entity cannot outsource: its own offices still hold the laptops and the paper.