What does 9.10 require regarding physical access to cardholder data?

What does 9.10 require regarding physical access to cardholder data?

• A. Security policies must be documented, in use, and known to all affected parties
• B. Policies must be optional
• C. Policies apply only to IT staff
• D. Policies require daily check-ins

Answer: (A)

Physical access to cardholder data is governed by formal policies that are documented, actively implemented, and clearly communicated to everyone who needs to know. PCI DSS expects organizations to have written security policies and procedures that specify how access to facilities and systems housing cardholder data is granted, monitored, and revoked, and to ensure those policies are understood by all affected personnel. When policies are documented and in use, there’s a consistent, auditable approach that helps prevent unauthorized entry and reinforces proper handling and safeguarding of data. Communicating these policies to all who have or might gain access reduces ambiguity and supports accountability, which is essential for effective access controls. Options that suggest policies are optional, apply only to IT staff, or require daily check-ins do not align with how PCI DSS structures physical access controls. Policies must be formal and shared with all relevant roles, not just a subset, and routine daily check-ins are not a standard requirement for this control.

Physical access to cardholder data is governed by formal policies that are documented, actively implemented, and clearly communicated to everyone who needs to know. PCI DSS expects organizations to have written security policies and procedures that specify how access to facilities and systems housing cardholder data is granted, monitored, and revoked, and to ensure those policies are understood by all affected personnel. When policies are documented and in use, there’s a consistent, auditable approach that helps prevent unauthorized entry and reinforces proper handling and safeguarding of data. Communicating these policies to all who have or might gain access reduces ambiguity and supports accountability, which is essential for effective access controls.

Options that suggest policies are optional, apply only to IT staff, or require daily check-ins do not align with how PCI DSS structures physical access controls. Policies must be formal and shared with all relevant roles, not just a subset, and routine daily check-ins are not a standard requirement for this control.