9.2.1.1 Monitoring of entry to sensitive areas
Individual physical entry into sensitive areas within the CDE must be monitored by video cameras, physical access control mechanisms, or both, such that: all points of entry to and exit from these sensitive areas are covered; the cameras or access mechanisms are shielded against tampering or being disabled; the collected data is reviewed and matched against other entry records; and the data is kept for at least three months where the law permits. The guidance suggests, for example, placing cameras out of reach or monitoring them to detect tampering, and says the chosen mechanism should cover every entry and exit point. Applicability: all entities with sensitive areas inside the CDE. Objective under the customized approach: trustworthy, verifiable records exist of each person entering and leaving sensitive areas.
Source: PCI DSS v4.0.1, 9.2.1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.
Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- CCTV and badge system retention settings showing at least three months of stored data · Physical access / facilities
- Tamper alerts or physical protection details for cameras and readers · Physical access / facilities
- Sample footage or badge logs retrieved from three months earlier · Physical access / facilities
periodic reviewEvidence produced at each review
- Records of periodic review correlating badge events with video footage or other entries · Physical access / facilities
governing documentDocuments that govern the control
- Camera placement diagram and access reader map covering every entry and exit of each sensitive area · Policy repository / GRC workspace
First move
Common gaps auditors find
- Cameras cover the main door but not a secondary exit from the data center
- DVR overwrites footage after 30 days
- Footage retained but never reviewed or correlated with badge logs
- Cameras mounted within easy reach and not monitored for tampering
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet9.2.1 Facility entry controls for CDE systems · 9.2.2 Controls on publicly accessible network jacks