9.3 Physical access to sensitive areas controlled
What the standard requires
The PCI SSC publishes the standard at no cost under a click-through licence that does not permit redistribution, so the requirement text cannot be embedded here.
The security standard for organizations that store, process, or transmit payment card data, structured as 12 principal requirements covering network security, cardholder data protection, vulnerability management, access control, monitoring, and policy. Each requirement expands into testing procedures used in a Report on Compliance.
Download free from the PCI SSC Document Library →If your organisation holds a licence for PCI DSS v4.0.1, CMDash can load the real text against every control through the framework import, where it is stamped as tenant-provided.
Cross-framework mappings
No cross-framework mapping is seeded for this control. That is stated rather than filled in: a mapping nobody authored is worse than a gap you can see.
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.