PCI DSS · Requirement 9: Restrict physical access to cardholder data

POI devices inspected for tampering

frameworkPCI DSS v4.0.1 sectionRequirement 9: Restrict physical access to cardholder data csf 2.0DE.CM-02 GV.SC-09 ID.AM-01 PR.AA-06 topics— frameworks0 0 0

Official text · not licensableSummary (ControlMapping's wording): POI devices inspected for tampering. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 9.5.1.2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-02 GV.SC-09 ID.AM-01 PR.AA-06	The physical environment is monitored to find potentially adverse events; Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle…	Loosely related	No mapping. Only shares CSF DE.CM-02, GV.SC-09, ID.AM-01, PR.AA-06: related, not a mapping
ISO 27001	A.7.4 A.5.9 A.5.19 A.5.20	Physical security monitoring; Inventory of information and other associated assets…	Loosely related	No mapping. Only shares CSF DE.CM-02, PR.AA-06, ID.AM-01, GV.SC-09: related, not a mapping +8 more loosely related (not mappings) A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-09: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-09: related, not a mapping A.7.1 Physical security perimeters Loosely related Only shares CSF PR.AA-06: related, not a mapping A.7.2 Physical entry Loosely related Only shares CSF PR.AA-06: related, not a mapping …and 4 more in the downloads
CIS v8.1	CIS 1.1 CIS 15.6 CIS 1.2 CIS 1.3	Establish and Maintain Detailed Enterprise Asset Inventory; Monitor Service Providers…	Loosely related	No mapping. Only shares CSF ID.AM-01, GV.SC-09: related, not a mapping +5 more loosely related (not mappings) CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-01: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-01: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-01: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-01: related, not a mapping …and 1 more in the downloads
SOC 2	CC6.4 CC6.1 CC9.2	Physical access restrictions; Logical access security over information assets…	Loosely related	No mapping. Only shares CSF DE.CM-02, PR.AA-06, ID.AM-01, GV.SC-09: related, not a mapping
CMMC	PE.L2-3.10.2 PE.L2-3.10.3 PE.L2-3.10.4 PE.L2-3.10.5	Monitor Facility; Escort Visitors…	Loosely related	No mapping. Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping +5 more loosely related (not mappings) CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.CM-02: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-02: related, not a mapping PE.L2-3.10.1 Limit Physical Access Loosely related Only shares CSF PR.AA-06: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.SC-09: related, not a mapping …and 1 more in the downloads
800-53	PE-3 PE-6 PE-20 CA-7	Physical Access Control; Monitoring Physical Access…	Loosely related	No mapping. Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping +21 more loosely related (not mappings) CM-8 System Component Inventory Loosely related Only shares CSF ID.AM-01: related, not a mapping PE-2 Physical Access Authorizations Loosely related Only shares CSF PR.AA-06: related, not a mapping PE-4 Access Control for Transmission Loosely related Only shares CSF PR.AA-06: related, not a mapping PE-5 Access Control for Output Devices Loosely related Only shares CSF PR.AA-06: related, not a mapping …and 17 more in the downloads
HIPAA	§164.310(d)§164.310(d)(2)(iii)§164.310(a)§164.310(a)(2)(i)	Device and Media Controls; Accountability…	Loosely related	No mapping. Only shares CSF DE.CM-02, ID.AM-01, PR.AA-06: related, not a mapping +16 more loosely related (not mappings) §164.310(a)(2)(iii) Access Control and Validation Procedures Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping §164.310(b) Workstation Use Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping §164.310(c) Workstation Security Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Loosely related Only shares CSF GV.SC-09: related, not a mapping …and 12 more in the downloads
GDPR	Art.28(1)Art.30(1)	Processor; Records of processing activities	Loosely related	No mapping. Only shares CSF GV.SC-09, ID.AM-01: related, not a mapping
NIS2	13.3 5.1 11.5 12.4	Perimeter and physical access control; Supply chain security policy…	Loosely related	No mapping. Only shares CSF DE.CM-02, PR.AA-06, GV.SC-09, ID.AM-01: related, not a mapping +1 more loosely related (not mappings) 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-02: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-01: related, not a mapping
DORA	Art.6(2)Art.9(4)(c)Art.8(1)Art.8(4)	ICT risk management framework; Protection and prevention…	Loosely related	No mapping. Only shares CSF DE.CM-02, PR.AA-06, ID.AM-01: related, not a mapping +4 more loosely related (not mappings) Art.8(6) Identification Loosely related Only shares CSF ID.AM-01: related, not a mapping Art.28(2) General principles Loosely related Only shares CSF GV.SC-09: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-09: related, not a mapping
CPS 234	Para 16 Para 20 Para 22	Assess third parties' information security capability; Classify information assets by criticality and sensitivity…	Loosely related	No mapping. Only shares CSF GV.SC-09, ID.AM-01: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.