What is the main purpose of req 9.4?

What is the main purpose of req 9.4?

• A. To store visitor logs for 1 year only
• B. To authorize visitors and control their access to areas where cardholder data is processed or maintained
• C. To restrict all access to the facility to internal staff only
• D. To eliminate the use of badges

Answer: (B)

The main concept is controlling physical access to areas where cardholder data is processed or stored. PCI DSS requires systems to verify who is allowed into sensitive spaces and to manage that access, so visitors are properly authorized and either escorted or restricted to appropriate zones. This reduces the risk of unauthorized entry, tampering, or theft of cardholder data by ensuring that only vetted individuals can reach the CHD environment and that their presence is tracked. The other options miss the point: storing visitor logs, restricting access only to internal staff, or removing badges don’t align with the goal of validating and controlling entry to sensitive areas.

The main concept is controlling physical access to areas where cardholder data is processed or stored. PCI DSS requires systems to verify who is allowed into sensitive spaces and to manage that access, so visitors are properly authorized and either escorted or restricted to appropriate zones. This reduces the risk of unauthorized entry, tampering, or theft of cardholder data by ensuring that only vetted individuals can reach the CHD environment and that their presence is tracked. The other options miss the point: storing visitor logs, restricting access only to internal staff, or removing badges don’t align with the goal of validating and controlling entry to sensitive areas.