There is a server room which is part of PCI environment and located inside the office. Access to the server room itself is controlled according to PCI DSS Requirement 9: "Restrict physical access to cardholder data" (lock, badge, key-pad, cameras etc.).
Question: Do we need to apply office-wide control to satisfy requirement 9.4 "Implement procedures to identify and authorize visitors." in order to ensure that server room is in compliance?
Specifically, do we need to apply the following procedures to regular office visitors:
- Visitor identification with government issued photo ID;
- Visitor sign-in log (timestamp, name, company, sponsor);
- Visitor to be escorted all the time by their sponsor;
- Visitor sign-out log on exit.
Management is OK with visitor-specific badges, but considering additional controls as overkill.