What evidence do auditors commonly ask for on 9.5.1.3 Training for personnel in POI environments?

POI tamper awareness training content covering technician verification, device swap verification, suspicious behaviour and reporting; Training completion records for cashiers, store managers and other POI personnel; Escalation contacts and reporting procedure posted at points of sale; Interview notes with store staff demonstrating knowledge of the procedures; Records of verification calls to vendor or acquirer before technician access.

What is the most common gap auditors find on 9.5.1.3?

Training covers general security awareness but not POI tampering

PCI DSS v4.0.1 · Req 9: Restrict Physical Access

`9.5.1.3` Training for personnel in POI environments

Personnel working in POI environments must receive training to recognise attempted tampering with, or replacement of, POI devices, and the training must cover: checking the identity of any third party who says they are repair or maintenance staff before letting them modify or troubleshoot devices; procedures ensuring no device is installed, returned or replaced unless it has first been verified; being alert to suspicious behaviour around devices; and reporting suspicious behaviour and signs of tampering or substitution to the appropriate personnel. Applicability: personnel in environments with deployed card-present POI devices. Objective under the customized approach: personnel understand the attacks made on POI devices and the technical and procedural countermeasures the entity uses, and know how to get help and guidance when needed.

Source: PCI DSS v4.0.1, 9.5.1.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.

artefacts

held by a system

at each review

hard

to go live

HR system / LMS

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Training completion records for cashiers, store managers and other POI personnel · HR system / LMS

periodic reviewEvidence produced at each review

Interview notes with store staff demonstrating knowledge of the procedures · Policy repository / GRC workspace
Records of verification calls to vendor or acquirer before technician access · Vendor register / contract repository

governing documentDocuments that govern the control

POI tamper awareness training content covering technician verification, device swap verification, suspicious behaviour and reporting · HR system / LMS
Escalation contacts and reporting procedure posted at points of sale · Policy repository / GRC workspace

First move

Mostly documents and reviews. Pull the 1 system-held artefact from your HR system / LMS on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.

Common gaps auditors find

Training covers general security awareness but not POI tampering
Staff accept replacement terminals shipped by post without verifying the sender
New or seasonal staff not trained before working at the till
Staff do not know whom to report suspicious device activity to

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

9.5.1.2.1 Risk-based frequency and type of POI inspections · 10.1.1 Requirement 10 policies and procedures maintained and in use