Frequently Asked Question

PCI DSS Requirement 9.1.1 addresses the need for video cameras and/or access control mechanisms to monitor individual physical access to sensitive areas.  "Sensitive areas" refers to any data center, server room or any area that houses systems that store, process, or transmit cardholder data. Note that this excludes the areas where only point-of-sale terminals are present, such as the cashier areas in a retail store. This exclusion was included to recognize that such controls may not be practical or permitted in public-facing areas where cardholders are using their own payment cards.   

Because call-center environments contain systems that process, transmit and/or store cardholder data, such areas need to be protected from unauthorized physical access.  Without physical access controls, unauthorized persons could potentially gain access to the CDE and to sensitive information, or could alter system configurations, introduce vulnerabilities into the network, or destroy or steal equipment. The purpose of Requirement 9.1.1 is to ensure that all entry/exit points to sensitive areas are controlled and monitored, and that all individuals who physically access the area are identified.  Whichever mechanism is used to meet this requirement, it must be sufficient for the organization to verify that only authorized personnel are granted access.