0

There is a server room which is part of PCI environment and located inside the office. Access to the server room itself is controlled according to PCI DSS Requirement 9: "Restrict physical access to cardholder data" (lock, badge, key-pad, cameras etc.).

Question: Do we need to apply office-wide control to satisfy requirement 9.4 "Implement procedures to identify and authorize visitors." in order to ensure that server room is in compliance?

Specifically, do we need to apply the following procedures to regular office visitors:

  1. Visitor identification with government issued photo ID;
  2. Visitor sign-in log (timestamp, name, company, sponsor);
  3. Visitor to be escorted all the time by their sponsor;
  4. Visitor sign-out log on exit.

Management is OK with visitor-specific badges, but considering additional controls as overkill.

Improve this question
2
  • 1
    You PCI QSA really needs to weigh in on your particular situation, but #2-4 should be standard, regardless.
    – schroeder ♦
    Commented May 7, 2015 at 20:50
  • 1
    I concur with @schroeder. My impression based on one such experience is that QSAs react badly to having a PCI CDE datacenter external (walls, door) exposed to uncontrolled non-employees. In that one case, ISTR they indicated 1+2+4 was sufficient... but this is definitely a case where you need your QSA to bless it.
    – gowenfawr
    Commented May 8, 2015 at 4:25

1 Answer 1

Reset to default
1

A little late to this question, but just for the sake of this one having some sort of on-the-books "answer":

My read of 9.4 has always focused mainly on the 'visitor" element, as you imply. And I think that the list of four common-sensical measures you offer are definitely good ones But, keeping in mind the intent of the rule, let me suggest one more: For all visitors who your office people have never seen before and cannot vouch for, get on the phone with the services who supposedly sent them (don't use any phone numbers they give; look them up online) to verify their identification, that they are an employee of the service, and that somebody in the office is expecting a visit from them. The impostor third-party contractor/worker who talks his or her way into the facility is sort of the main threat scenario the rule aims at.

But as the commenters wisely said, ask your QSA.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .