Framework № PCI DSS 4.0 от 01.03.2022

9.5.1
Defined Approach Requirements: 
POI devices that capture payment card data via direct physical interaction with the payment card form factor are protected from tampering and unauthorized substitution, including the following:

Customized Approach Objective:
The entity has defined procedures to protect and manage point of interaction devices. Expectations, controls, and oversight for the management and protection of POI devices are defined and adhered to by affected personnel. 

Applicability Notes:
These requirements apply to deployed POI devices used in card-present transactions (that is, a payment card form factor such as a card that is swiped, tapped, or dipped). 
This requirement is not intended to apply to manual PAN key-entry components such as computer keyboards. This requirement is recommended, but not required, for manual PAN key-entry components such as computer keyboards. 
This requirement does not apply to commercial offthe-shelf (COTS) devices (for example, smartphones or tablets), which are mobile merchant-owned devices designed for mass-market distribution. 

Defined Approach Testing Procedures:

Purpose:
riminals attempt to steal payment card data by stealing and/or manipulating card-reading devices and terminals. Criminals will try to steal devices so they can learn how to break into them, and they often try to replace legitimate devices with fraudulent devices that send them payment card data every time a card is entered. 
They will also try to add “skimming” components to the outside of devices, which are designed to capture payment card data before it enters the device—for example, by attaching an additional card reader on top of the legitimate card reader so that the payment card data is captured twice: once by the criminal’s component and then by the device’s legitimate component. In this way, transactions may still be completed without interruption while the criminal is “skimming” the payment card data during the process. 

Good Practice:
Additional best practices on skimming prevention are available on the PCI SSC website. 

9.5.1.1
Defined Approach Requirements: 
An up-to-date list of POI devices is maintained, including:

Customized Approach Objective:
The identity and location of POI devices is recorded and known at all times. 

Defined Approach Testing Procedures:

Purpose:
Keeping an up-to-date list of POI devices helps an organization track where devices are supposed to be and quickly identify if a device is missing or lost. 

Good Practice:
The method for maintaining a list of devices may be automated (for example, a devicemanagement system) or manual (for example, documented in electronic or paper records). For on-the-road devices, the location may include the name of the personnel to whom the device is assigned. 

Examples:
Methods to maintain device locations include identifying the address of the site or facility where the device is located.