Physical Security

Applies to. Requirement 9 is where physical security meets the standard. 9.2.1 asks for appropriate facility entry controls that restrict physical access to systems in the CDE, and the assessor verifies it by observing the entry controls and interviewing the people responsible for them. The rest of Requirement 9 extends that to authorising and managing personnel and visitor access, securing and destroying media, and protecting point-of-interaction devices from tampering.

Limits. The physical security tokens in 8.3.11 are authentication factors that must be assigned to one user and protected from use by anyone else; that requirement is about identity, not about securing a facility.