PCI DSS · Requirement 9: Restrict physical access to cardholder data

Sensitive-area access authorised and revoked promptly

frameworkPCI DSS v4.0.1 sectionRequirement 9: Restrict physical access to cardholder data csf 2.0DE.CM-02 GV.RR-04 GV.SC-10 PR.AA-06 PR.DS-11 topicsPhysical Security frameworks6 2 2

Official text · not licensableSummary (ControlMapping's wording): Sensitive-area access authorised and revoked promptly. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 9.3.1.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-02 PR.AA-06 PR.IR-02	The physical environment is monitored to find potentially adverse events; Physical access to assets is managed, monitored, and enforced commensurate with risk…	Crosswalk	Same topic: Physical Security 3 loosely related (not mappings) GV.RR-04 Cybersecurity is included in human resources practices Loosely related Only shares CSF GV.RR-04: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping PR.DS-11 Backups of data are created, protected, maintained, and tested Loosely related Only shares CSF PR.DS-11: related, not a mapping
ISO 27001	A.7.1 A.7.2 A.7.3 A.7.4 A.7.5 A.7.6 A.7.8 A.7.11 A.7.12	Physical security perimeters; Physical entry…	Crosswalk	Same topic: Physical Security 17 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.SC-10: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-10: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-10: related, not a mapping A.6.1 Screening Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.3 Information security awareness, education and training Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.4 Disciplinary process Loosely related Only shares CSF GV.RR-04: related, not a mapping …and 9 more in the downloads
CIS v8.1	CIS 6.1 CIS 6.2 CIS 11.2 CIS 11.3	Establish an Access Granting Process; Establish an Access Revoking Process…	Loosely related	No mapping. Only shares CSF GV.RR-04, PR.DS-11: related, not a mapping +3 more loosely related (not mappings) CIS 11.5 Test Data Recovery Loosely related Only shares CSF PR.DS-11: related, not a mapping CIS 15.7 Securely Decommission Service Providers Loosely related Only shares CSF GV.SC-10: related, not a mapping CIS 11.4 Establish and Maintain an Isolated Instance of Recovery Data Loosely related Only shares CSF PR.DS-11: related, not a mapping
SOC 2	CC6.4	Physical access restrictions	Editorial	Same topic: Physical Security (editorial pick) 1 loosely related (not mappings) A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF PR.DS-11: related, not a mapping
CMMC	PE.L2-3.10.1 PE.L2-3.10.2 PE.L2-3.10.3 PE.L2-3.10.4 PE.L2-3.10.5 PE.L2-3.10.6	Limit Physical Access; Monitor Facility…	Crosswalk	Same topic: Physical Security 9 loosely related (not mappings) CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.CM-02: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-02: related, not a mapping MP.L2-3.8.9 Protect Backups Loosely related Only shares CSF PR.DS-11: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.SC-10: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF GV.SC-10: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF GV.SC-10: related, not a mapping AT.L2-3.2.3 Insider Threat Awareness Loosely related Only shares CSF GV.RR-04: related, not a mapping AU.L2-3.3.2 User Accountability Loosely related Only shares CSF GV.RR-04: related, not a mapping …and 1 more in the downloads
800-53	PE-2 PE-3 PE-6 PE-8 PE-13 PE-14	Physical Access Authorizations; Physical Access Control…	Crosswalk	Same topic: Physical Security 23 loosely related (not mappings) PE-20 Asset Monitoring and Tracking Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-02: related, not a mapping CP-6 Alternate Storage Site Loosely related Only shares CSF PR.DS-11: related, not a mapping CP-9 System Backup Loosely related Only shares CSF PR.DS-11: related, not a mapping PE-4 Access Control for Transmission Loosely related Only shares CSF PR.AA-06: related, not a mapping PE-5 Access Control for Output Devices Loosely related Only shares CSF PR.AA-06: related, not a mapping PE-18 Location of System Components Loosely related Only shares CSF PR.AA-06: related, not a mapping PE-19 Information Leakage Loosely related Only shares CSF PR.AA-06: related, not a mapping …and 15 more in the downloads
HIPAA	§164.310(a)§164.310(a)(2)(iii)§164.310(b)§164.310(c)§164.310(a)(2)(ii)	Facility Access Controls; Access Control and Validation Procedures…	Crosswalk	Same topic: Physical Security 26 loosely related (not mappings) §164.310(a)(2)(i) Contingency Operations Loosely related Only shares CSF DE.CM-02, PR.AA-06, PR.DS-11: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.RR-04, GV.SC-10: related, not a mapping §164.310(d) Device and Media Controls Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping §164.310(d)(2)(iii) Accountability Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF GV.RR-04, GV.SC-10: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.RR-04, GV.SC-10: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.RR-04, GV.SC-10: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.RR-04, GV.SC-10: related, not a mapping …and 18 more in the downloads
GDPR	Art.29 Art.32(1)(c)Art.32(4)	Processing under the authority of the controller or processor; Security of processing…	Loosely related	No mapping. Only shares CSF GV.RR-04, PR.DS-11: related, not a mapping
NIS2	13.1 13.2 13.3	Supporting utilities; Protection against physical and environmental threats…	Crosswalk	Same topic: Physical Security 6 loosely related (not mappings) 4.2 Backup management Loosely related Only shares CSF PR.DS-11: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.SC-10: related, not a mapping 10.1 Human resources security Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.2 Verification of Background Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.3 Termination or change of employment procedures Loosely related Only shares CSF GV.RR-04: related, not a mapping 11.5 Identification Loosely related Only shares CSF PR.AA-06: related, not a mapping
Essential Eight	ISM-1511 ISM-1515 ISM-1705 ISM-1706	Backups of data, applications and settings are performed and retained in accordance…; Restoration of data, applications and settings from backups to a common point in time……	Loosely related	No mapping. Only shares CSF PR.DS-11: related, not a mapping +7 more loosely related (not mappings) ISM-1707 Privileged user accounts (excluding backup administrator accounts) are prevented from… Loosely related Only shares CSF PR.DS-11: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Loosely related Only shares CSF PR.DS-11: related, not a mapping ISM-1810 Backups of data, applications and settings are synchronised to enable restoration to a… Loosely related Only shares CSF PR.DS-11: related, not a mapping ISM-1811 Backups of data, applications and settings are retained in a secure and resilient manner Loosely related Only shares CSF PR.DS-11: related, not a mapping …and 3 more in the downloads
DORA	Art.6(2)Art.9(4)(c)	ICT risk management framework; Protection and prevention	Editorial	Same topic: Physical Security (editorial pick) 4 loosely related (not mappings) Art.10(3) Detection Loosely related Only shares CSF GV.RR-04: related, not a mapping Art.12(1) Backup policies and procedures, restoration and recovery procedures and methods Loosely related Only shares CSF PR.DS-11: related, not a mapping Art.12(2) Backup policies and procedures, restoration and recovery procedures and methods Loosely related Only shares CSF PR.DS-11: related, not a mapping Art.12(3) Backup policies and procedures, restoration and recovery procedures and methods Loosely related Only shares CSF PR.DS-11: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.