9.3.4 Visitor logs for facility and sensitive areas
Visitor logs must keep a physical record of visitor activity inside the facility and inside sensitive areas, capturing: who the visitor is and which organization they come from; the visit date and time; and the name of the person who authorized their physical access. The log is to be retained for at least three months where the law permits. Recording both arrival and departure times, and checking the visitor's ID against the name they record, is described in the guidance as good practice, not a requirement. Applicability: all entities. Objective under the customized approach: visitor access is recorded in a way that lets individuals be identified.
Source: PCI DSS v4.0.1, 9.3.4. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.
Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Facility visitor log and separate or combined sensitive-area visitor log · Physical access / facilities
- Electronic visitor system retention setting or archived paper logs covering at least three months · Physical access / facilities
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Sample entries showing visitor name, organization, date, time and authorizing person · Policy repository / GRC workspace
- Retention procedure for visitor logs noting any legal restrictions · Policy repository / GRC workspace
First move
Common gaps auditors find
- Data center visitor log missing the name of the authorizing person
- Visitor logs kept only at the building lobby, not for sensitive areas
- Old visitor sheets discarded after a few weeks
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet9.3.3 Visitor badges returned or deactivated · 9.4.1 Physical security of all media