Which items must be included in an up-to-date list of devices per 9.9.1?

Which items must be included in an up-to-date list of devices per 9.9.1?

• A. Make and model only.
• B. Location only.
• C. Make, model, and serial number only.
• D. Make, model, location, and serial number or other unique ID.

Answer: (D)

The requirement tests maintaining an up-to-date inventory of devices that touch or connect to the cardholder data environment, with enough detail to uniquely identify each device and its location. Including make, model, location, and a serial number or other unique ID gives you a complete, actionable record: you know what the device is, where it’s deployed, and exactly which unit it is. Make and model show the type of hardware, location pins down where it sits for physical security and incident response, and the serial number or unique ID lets you distinguish between identical devices and track their lifecycle and maintenance. Make and model alone can’t tell you where to find the device or distinguish between units; location alone doesn’t identify the device itself; including serial number without location misses where the device is physically situated, which is important for access control and quick remediation.

The requirement tests maintaining an up-to-date inventory of devices that touch or connect to the cardholder data environment, with enough detail to uniquely identify each device and its location. Including make, model, location, and a serial number or other unique ID gives you a complete, actionable record: you know what the device is, where it’s deployed, and exactly which unit it is. Make and model show the type of hardware, location pins down where it sits for physical security and incident response, and the serial number or unique ID lets you distinguish between identical devices and track their lifecycle and maintenance.

Make and model alone can’t tell you where to find the device or distinguish between units; location alone doesn’t identify the device itself; including serial number without location misses where the device is physically situated, which is important for access control and quick remediation.