Physical Security Requirements
Scope of the domain
This domain tests the physical controls around card production: how blank card stock, finished cards, personalization equipment, and sensitive components are protected from theft, substitution, and unauthorized access. The PCI Card Production and Provisioning – Physical Security Requirements set the baseline, and assessors look for implemented, evidenced controls rather than policy statements.
Facility and access control
- The secure production area must have solid walls, floor, and ceiling, with controlled entry points; windows and other openings must be protected or eliminated.
- Access to card production and card storage areas requires two-factor authentication (for example, badge plus biometric or PIN). A single badge or key is not enough.
- Visitors must be logged, badged, and escorted at all times; access rights must be reviewed and revoked promptly when staff leave.
- Vaults and high-value storage areas use dual control: no one person can open them alone.
Surveillance, inventory, and destruction
- CCTV must cover entry/exit, vaults, personalization, and destruction areas; recordings are time-stamped and retained for at least 30 days.
- Intrusion detection must be monitored and tested; alarms must trigger a response.
- Card stock and finished cards are inventoried at receiving, at shift changes, and before shipment; discrepancies are investigated and logged.
- Destruction must render cards and chips unusable-cross-cut shredding to the specified particle size, burning, or disintegration-and must be witnessed and recorded.
Worked example
A clerk leaves a pallet of blank cards beside the embosser over the weekend because the vault is full. Failures: card stock outside controlled storage, no reconciliation at shift end, and no dual-control transfer. Compliant handling: receive at a secured dock, count against the manifest, move directly to the vault under CCTV, record the transfer, and escalate any count difference before production.
Traps
- Treating a locked door as compliant access control; two-factor authentication is required.
- Forgetting visitor escort and access reviews.
- Assuming ordinary strip-cut shredding destroys card stock.
- Recording CCTV but retaining it for less than the required period.