PCI DSS · Requirement 9: Restrict physical access to cardholder data

Physical access to network hardware restricted

frameworkPCI DSS v4.0.1 sectionRequirement 9: Restrict physical access to cardholder data csf 2.0PR.AA-06 topicsPhysical Security frameworks6 2 5

Official text · not licensableSummary (ControlMapping's wording): Physical access to network hardware restricted. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 9.2.3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-02 PR.AA-06 PR.IR-02	The physical environment is monitored to find potentially adverse events; Physical access to assets is managed, monitored, and enforced commensurate with risk…	Crosswalk	Same topic: Physical Security
ISO 27001	A.7.1 A.7.2 A.7.3 A.7.4 A.7.5 A.7.6 A.7.8 A.7.11 A.7.12	Physical security perimeters; Physical entry…	Crosswalk	Same topic: Physical Security
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	CC6.4	Physical access restrictions	Editorial	Same topic: Physical Security (editorial pick)
CMMC	PE.L2-3.10.1 PE.L2-3.10.2 PE.L2-3.10.3 PE.L2-3.10.4 PE.L2-3.10.5 PE.L2-3.10.6	Limit Physical Access; Monitor Facility…	Crosswalk	Same topic: Physical Security
800-53	PE-2 PE-3 PE-6 PE-8 PE-13 PE-14	Physical Access Authorizations; Physical Access Control…	Crosswalk	Same topic: Physical Security 5 loosely related (not mappings) PE-4 Access Control for Transmission Loosely related Only shares CSF PR.AA-06: related, not a mapping PE-5 Access Control for Output Devices Loosely related Only shares CSF PR.AA-06: related, not a mapping PE-18 Location of System Components Loosely related Only shares CSF PR.AA-06: related, not a mapping PE-19 Information Leakage Loosely related Only shares CSF PR.AA-06: related, not a mapping PE-20 Asset Monitoring and Tracking Loosely related Only shares CSF PR.AA-06: related, not a mapping
HIPAA	§164.310(a)§164.310(a)(2)(iii)§164.310(b)§164.310(c)§164.310(a)(2)(ii)	Facility Access Controls; Access Control and Validation Procedures…	Crosswalk	Same topic: Physical Security 3 loosely related (not mappings) §164.310(a)(2)(i) Contingency Operations Loosely related Only shares CSF PR.AA-06: related, not a mapping §164.310(d) Device and Media Controls Loosely related Only shares CSF PR.AA-06: related, not a mapping §164.310(d)(2)(iii) Accountability Loosely related Only shares CSF PR.AA-06: related, not a mapping
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	13.1 13.2 13.3	Supporting utilities; Protection against physical and environmental threats…	Crosswalk	Same topic: Physical Security 1 loosely related (not mappings) 11.5 Identification Loosely related Only shares CSF PR.AA-06: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.6(2)Art.9(4)(c)	ICT risk management framework; Protection and prevention	Editorial	Same topic: Physical Security (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.