Visitor
PCIComplianceHubLast updated
A vendor, a guest of an employee, a service worker, or a member of staff who does not normally have access to the area in question. A customer buying something in a shop is not a visitor; the term is for people who need to be let in to somewhere they do not belong by default.
Applies to. Every facility with a CDE or a sensitive area. Requirement 9.3 governs how visitors get in, are identified while inside, and are recorded.
Example. An air-conditioning technician working in the server room is a visitor: authorised before entering, escorted throughout, wearing a badge that distinguishes them from personnel, surrendering it on the way out (9.3.2), and recorded in a visitor log kept for at least three months (9.3.3).
Limits. The definition includes the entity's own personnel when they are somewhere they have no standing access to, which is the case most often missed. Cardholders in retail areas are excluded because the shop floor is not a sensitive area. Where visitors are given badges, 9.3.4 requires those badges to be controlled the same way personnel's are.