9.2.1 Appropriate facility entry controls are in place to restrict physical access to systems in the CDE
Appropriate facility entry controls are in place to restrict physical access to systems in the CDE.
5
artefacts
1
held by a system
3
at each review
hard
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Records showing entry control failures such as propped or faulty doors are detected and fixed · Physical access / facilities
periodic reviewEvidence produced at each review
- Observation records or photographs of the entry controls restricting physical access to systems in the cardholder data environment · Physical access / facilities
- Evidence all entry points are covered, including loading docks, fire doors and shared tenancy access · Physical access / facilities
- Interview confirmation from responsible personnel about how access is restricted · Physical access / facilities
governing documentDocuments that govern the control
- Documentation of the control mechanism, such as badge readers, locks or staffed reception, at each entry point · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Physical access / facilities on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Main entrance controlled while secondary doors, service risers and roof access are not
- Shared building tenancy where landlord controlled areas provide an uncontrolled route
- Doors held open for convenience with no monitoring that would detect it
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet9.1.2 Roles and responsibilities for performing activities in Requirement 9 are documented, assigned, and understood · 9.2.1.1 Individual physical access to sensitive areas within the CDE is monitored with either video cameras or physical access control mechanisms (or both) as follows: • Entry and exit points to/from sensitive areas within the