Which PCI DSS requirement requires restricting physical access to cardholder data?

Which PCI DSS requirement requires restricting physical access to cardholder data?

• A. Requirement 2
• B. Requirement 12
• C. Requirement 6
• D. Requirement 9

Answer: (D)

Restricting physical access to cardholder data focuses on the controls that physically protect the places and devices where CHD is stored or processed. This requirement explicitly mandates limiting who can enter facilities, rooms, and areas containing CHD, as well as securing media, devices, and backups that hold cardholder data, and ensuring visitors are escorted and monitored. It also covers procedures for secure disposal of hardware and media to prevent CHD exposure through physical means. This is the best fit because the question is asking about physical protection, not about password practices, policy development, or software security—areas addressed by the other options. The other requirements cover logical access, secure systems and applications, and formal security governance, which are essential but do not address the physical access controls that guard CHD in the real world.

Restricting physical access to cardholder data focuses on the controls that physically protect the places and devices where CHD is stored or processed. This requirement explicitly mandates limiting who can enter facilities, rooms, and areas containing CHD, as well as securing media, devices, and backups that hold cardholder data, and ensuring visitors are escorted and monitored. It also covers procedures for secure disposal of hardware and media to prevent CHD exposure through physical means. This is the best fit because the question is asking about physical protection, not about password practices, policy development, or software security—areas addressed by the other options. The other requirements cover logical access, secure systems and applications, and formal security governance, which are essential but do not address the physical access controls that guard CHD in the real world.