PCI DSS 9.1.1: Documenting Physical Security Policies

What this means

This control requires your organization to create comprehensive documentation covering all physical security policies and procedures mandated by PCI DSS Requirement 9. These policies must remain current and aligned with your actual security practices, be actively used by your organization, and be communicated to and understood by every employee and contractor who accesses your facilities or cardholder data environments.

How to comply

1. 1.Create a physical security policy document that covers access control, visitor management, surveillance, and facility monitoring
2. 2.Document all procedures for implementing each physical security measure, including step-by-step processes
3. 3.Establish a review and update schedule to keep policies current with operational changes and evolving threats
4. 4.Distribute policies to all relevant staff and maintain records of acknowledgment and training completion
5. 5.Designate a policy owner responsible for maintenance, updates, and enforcement
6. 6.Include policy version control, effective dates, and revision history for audit trails

Evidence auditors look for

• Physical security policy document with table of contents covering all Requirement 9 elements
• Dated acknowledgment forms signed by employees confirming receipt and understanding of policies
• Policy review records showing updates within the past 12 months
• Training attendance logs demonstrating staff education on physical security procedures
• Procedure documentation for badge access, visitor check-in, and facility patrols
• Evidence of policy distribution through employee handbooks, intranets, or email records

Frequently asked questions

GRCWatch automates policy version control and tracks staff acknowledgment electronically, eliminating manual tracking and ensuring every team member's understanding of physical security policies is documented and audit-ready.

See how GRCWatch handles this control automatically

Related controls