Question 1

What evidence do auditors ask for on 9.1.1 All security policies and operational procedures that are identified in Requirement 9 are: • Documented. • Kept up to date. • In use. • Known to all affected parties?

Accepted Answer

Documented policies and operational procedures for physical access to the cardholder data environment, media handling and point of interaction device protection; Review record showing the physical security procedures are kept up to date; Evidence of use, such as visitor logs and media transport records completed under the procedures; Distribution evidence to facilities, reception, operations and any third party providing physical security.

Question 2

Can 9.1.1 be evidenced continuously rather than by periodic review?

Accepted Answer

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Question 3

What is the most common gap auditors find on 9.1.1?

Accepted Answer

Procedures held by security with reception and facilities staff, who actually perform the activities, unaware of them

`9.1.1` All security policies and operational procedures that are identified in Requirement 9 are: • Documented. • Kept up to date. • In use. • Known to all affected parties

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet