Framework № PCI DSS 4.0 от 01.03.2022

9.3.1
Defined Approach Requirements: 
Procedures are implemented for authorizing and managing physical access of personnel to the CDE, including:

Customized Approach Objective:
Requirements for access to the physical CDE are defined and enforced to identify and authorize personnel. 

Defined Approach Testing Procedures:

Purpose:
Establishing procedures for granting, managing, and removing access when it is no longer needed ensures non-authorized individuals are prevented from gaining access to areas containing cardholder data. In addition, it is important to limit access to the actual badging system and badging materials to prevent unauthorized personnel from making their own badges and/or setting up their own access rules. 

Good Practice:
It is important to visually identify the personnel that are physically present, and whether the individual is a visitor or an employee. 

Examples:
One way to identify personnel is to assign them badges. 

9.3.1.1
Defined Approach Requirements: 
 Physical access to sensitive areas within the CDE for personnel is controlled as follows: 

Customized Approach Objective:
Sensitive areas cannot be accessed by unauthorized personnel. 

Defined Approach Testing Procedures:

Purpose:
Controlling physical access to sensitive areas helps ensure that only authorized personnel with a legitimate business need are granted access. 

Good Practice:
Where possible, organizations should have policies and procedures to ensure that before personnel leaving the organization, all physical access mechanisms are returned, or disabled as soon as possible upon their departure. This will ensure personnel cannot gain physical access to sensitive areas once their employment has ended. 

9.3.2
Defined Approach Requirements: 
Procedures are implemented for authorizing and managing visitor access to the CDE, including:

Customized Approach Objective:
Requirements for visitor access to the CDE are defined and enforced. Visitors cannot exceed any authorized physical access allowed while in the CDE. 

Defined Approach Testing Procedures:

Purpose:
Visitor controls are important to reduce the ability of unauthorized and malicious persons to gain access to facilities and potentially to cardholder data. 
Visitor controls ensure visitors are identifiable as visitors so personnel can monitor their activities, and that their access is restricted to just the duration of their legitimate visit. 

9.3.3
Defined Approach Requirements: 
Visitor badges or identification are surrendered or deactivated before visitors leave the facility or at the date of expiration. 

Customized Approach Objective:
Visitor identification or badges cannot be reused after expiration. 

Defined Approach Testing Procedures:

Purpose:
Ensuring that visitor badges are returned or deactivated upon expiry or completion of the visit prevents malicious persons from using a previously authorized pass to gain physical access into the building after the visit has ended. 

9.3.4
Defined Approach Requirements: 
A visitor log is used to maintain a physical record of visitor activity within the facility and within sensitive areas, including:

Customized Approach Objective:
 Records of visitor access that enable the identification of individuals are maintained. 

Defined Approach Testing Procedures:

Purpose:
A visitor log documenting minimum information about the visitor is easy and inexpensive to maintain. It will assist in identifying historical physical access to a building or room and potential access to cardholder data. 

Good Practice:
When logging the date and time of visit, including both in and out times is considered a best practice, since it provides helpful tracking information and provides assurance that a visitor has left at the end of the day. It is also good to verify that a visitor’s ID (driver’s license, etc.) matches the name they put on the visitor log.