EvidenceSheet
PCI DSS 4.0 · Req 9: Restrict Physical Access

9.3.1.1 Personnel access readily revoked

Physical access to sensitive areas within the CDE for personnel is revoked immediately upon termination, with all physical access mechanisms returned or disabled.

5
artefacts
2
held by a system
1
at each review
moderate
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review

system holds itEvidence a system already holds

  • Badge disablement logs with timestamps · Physical access / facilities
  • Sample termination tickets · Ticketing / ITSM

periodic reviewEvidence produced at each review

  • Lost badge incident records · Physical access / facilities

governing documentDocuments that govern the control

  • Termination checklist with badge return step · Policy repository / GRC workspace
  • Reconciliation between HR exits and badge system · Policy repository / GRC workspace

First move

Start with the 2 of 5 artefacts that already live in a system (Physical access / facilities); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

9.3.1 Procedures are implemented for authorizing and managing physical access of personnel to the CDE, including: • Identifying personnel. • Managing changes to an individual's physical access requirements. • Revoking or terminating personnel identification. • · 9.3.2 Procedures are implemented for authorizing and managing visitor access to the CDE, including: • Visitors are authorized before entering. • Visitors are escorted at all times. • Visitors are clearly identified and given a