Automating PCI DSS physical security evidence for cardholder data

Physical security remains a practical, observable part of PCI DSS compliance. Requirement 9 focuses on protecting payment cards and cardholder data from unauthorised access, theft, copying, tampering and disposal. That includes the rooms where systems operate, the media that stores payment information, paper records, visitor activity and the movement of devices.

For Australian organisations, the evidence may span a Melbourne office, a hosted environment in Sydney, a third-party call centre in Manila and payment infrastructure operated by an acquiring bank. A spreadsheet can record some of this, but it rarely provides timely proof that controls operated throughout the assessment period. Automation gives security and compliance teams a consistent way to collect, validate and present that proof.

What requirement 9 covers in practice

PCI DSS requirement 9.1 addresses the protection of physical access to systems in the cardholder data environment. Organisations need appropriate entry controls, restricted areas, secure facilities and safeguards against unauthorised access. Depending on the environment, this can involve locked server rooms, badge readers, security personnel, CCTV, alarms and monitored loading areas.

Requirement 9.2 concerns physical access into sensitive areas. The organisation must control and monitor entry to facilities, systems and media that contain cardholder data. Access should be based on business need, promptly removed when a person changes role or leaves, and supported by records that show who entered, when and why.

Requirement 9.3 covers visitor management. Visitors should be authorised, identified, escorted where required and distinguished from staff. Visitor badges, sign-in records and escort details help establish that the organisation knew who was present in a restricted area. A reception book alone may be difficult to defend if entries are incomplete, illegible or retained for too short a period.

Requirement 9.4 addresses media protection. Paper and electronic media containing cardholder data must be securely stored, transported and destroyed when no longer needed. It also covers inventory, distribution, tracking and destruction procedures. For an Australian retailer, this might include printed merchant reports, backup tapes, replacement point-of-sale devices and removable media sent between stores.

Why manual evidence becomes unreliable

Physical security evidence is often spread across systems that were designed for operations rather than audits. A building management platform may hold swipe-card events, a visitor management tool may store guest records, a facilities provider may manage CCTV retention, and an IT service desk may document device disposal. These systems may use different identities, time zones and retention settings.

Manual collection creates gaps between the control and the evidence. A compliance analyst might export a door-access report once a quarter, discover that a former contractor still appears in the access list, then spend days asking facilities and human resources to explain the discrepancy. By the time an assessor reviews the material, the relevant CCTV footage may have been overwritten or a visitor record may be unavailable.

Australian organisations also need to account for distributed operations. A payment company in Sydney could use a colocation facility in Mascot, staff in Melbourne and a disaster recovery site in Perth. A hospitality group may have terminals across regional New South Wales and Queensland, while its central office retains printed settlement records. The evidence process must cover each location and service provider in scope rather than assume that the head office represents the whole environment.

Automation does not mean treating every access event as a violation. It means collecting relevant data continuously, applying agreed rules and routing exceptions to an accountable person. That distinction keeps the process useful for security teams instead of turning it into an unmanageable stream of alerts.

Evidence sources that support an audit trail

A strong evidence model starts with the control statement and works backwards to the systems that can prove it. For example, a control requiring restricted entry to a server room may need the approved access list, recent access events, leaver-removal records, visitor logs, security review results and a current description of the facility.

Useful evidence sources include:

Electronic access-control logs showing badge holder, door, timestamp and event type
Visitor management records showing host, purpose, arrival, departure and badge return
Physical access reviews signed by a facilities or security owner
CCTV retention settings and records of periodic checks
Asset registers for laptops, payment terminals, backup media and removable storage
Chain-of-custody records for media transported to another site or service provider
Certificates or attestations for secure destruction, shredding or degaussing
Contracts and responsibility matrices for colocation, cloud and managed facilities
Human resources events that trigger access removal for staff and contractors
Incident tickets documenting unusual entry, lost media or failed disposal

The most valuable automation connects these sources to people, facilities and assets. An identity record can be compared with the building access list, while an asset register can be compared with disposal tickets. A system can then flag a badge that remained active after termination, a visitor record without an escort, or a device marked as destroyed without supporting evidence.

Evidence should retain context as well as the raw event. An assessor may need to know which requirement the record supports, which location it relates to, who owns the control, when it was collected and whether it was reviewed. A dated export with a cryptographic hash, source identifier and collection history is more defensible than an anonymous spreadsheet attachment.

Mapping controls to automated collection

Automation works best when each PCI DSS requirement is translated into clear tests and evidence expectations. The following model shows how common physical security activities can be operationalised without confusing monitoring with the underlying control.

Physical security activity	Automated evidence source	Useful validation	Typical review outcome
Restrict entry to sensitive areas	Badge and door-access platform	Compare active badges with approved access list	Confirm access or investigate excess privilege
Manage visitors	Visitor management system	Check host, purpose, badge issue and departure	Confirm complete visitor record
Review facility access	Scheduled access review workflow	Require owner sign-off and record exceptions	Evidence of periodic review
Protect stored media	Asset and storage register	Match media location, custodian and classification	Confirm secure storage or remediate gaps
Transport media securely	Transfer or chain-of-custody record	Check sender, receiver, seal and timestamps	Prove controlled movement
Destroy media	Disposal ticket and provider certificate	Match asset ID and destruction date	Confirm destruction or raise exception
Monitor facility safeguards	Facilities or security inspection record	Check CCTV, locks, alarms and retention settings	Document inspection and follow-up

The platform should preserve the original evidence while also producing an assessor-friendly view. A dashboard can show the current state, but the audit package should retain historical snapshots, approvals, exceptions and remediation dates. That is especially important when a control was temporarily unavailable but compensating measures were applied.

A continuous assurance platform such as compliance programs can help connect these control requirements with recurring evidence tasks and ownership. The objective is to make collection part of normal operations, so a facilities manager or security lead handles an exception near the time it occurs rather than reconstructing months of activity before an assessment.

Handling providers, locations and scope

Many organisations do not operate the building where their payment systems run. A colocation provider may control guards, visitor screening, cameras, cages, environmental safeguards and destruction services. The customer still needs to understand which PCI DSS responsibilities remain its own and which are performed by the provider. Contracts, responsibility matrices, provider attestations and site-specific evidence should support that decision.

Cloud infrastructure does not remove physical security obligations from the PCI DSS assessment. A cloud provider may provide data-centre controls through its own compliance reports, while the customer remains responsible for logical access, configuration, media handling under its control and the accuracy of its scope. Physical evidence should be tied to the provider’s service and location rather than copied into a generic “cloud secure” folder.

Australian geography can make evidence collection more complex. A retailer may operate stores in Adelaide, Darwin and Hobart, with connectivity and facilities managed by different local suppliers. Regional sites may have fewer formal controls than a large Sydney office, so automated checks should identify location-specific risks such as shared keys, incomplete visitor registers or unmonitored storage rooms.

Scope discipline matters just as much as evidence volume. Start by identifying where cardholder data is stored, processed or transmitted, then map physical locations, devices, media and service providers to that cardholder data environment. Evidence from an office that never handles payment information may support general security but should not distract from controls around terminals, processing infrastructure and retained records.

Making evidence collection privacy-aware

Physical security records contain personal information. Badge identifiers, visitor names, photographs, vehicle details and CCTV footage may identify employees, contractors and customers. The organisation should define why each record is collected, who may access it, how long it is retained and how it is securely disposed of.

This is particularly relevant in Australia, where the Privacy Act and the Notifiable Data Breaches scheme influence how organisations manage personal information and respond to incidents. A PCI DSS evidence repository should therefore use role-based access, encryption, audit logging and a documented retention schedule. It should avoid copying full CCTV footage or unnecessary identity data when a verified control result and source reference are sufficient.

Privacy-aware evidence handling also reduces operational risk. Instead of placing visitor logs in a broadly shared compliance drive, the system can store restricted records with a control-level summary and a link to the authorised source. The evidence package can show that the process operated without giving every project member access to sensitive footage or personal details. Tauruseer’s privacy approach provides relevant context for considering how compliance evidence should be handled responsibly.

Retention must align with the assessment period, contractual requirements and the organisation’s privacy obligations. If a facilities vendor overwrites video after 30 days but the business expects quarterly review, the gap should be treated as a control design issue. Automation can detect retention settings, remind owners before evidence expires and record approved exceptions.

Building continuous assurance into daily operations

A practical implementation begins with a control inventory covering every relevant office, store, data centre, warehouse and service provider. Assign each control an owner, evidence source, collection frequency, retention rule and escalation path. Security teams can then prioritise high-risk areas instead of attempting to automate every facilities activity at once.

The most useful automated tests are specific. Examples include checking that all active badges belong to current workers, confirming that restricted-area access has an approved owner, detecting visitor records without departure times, and matching disposed assets to destruction certificates. Each test should define what happens when data is missing, delayed or contradictory.

Recommendations for dependable evidence automation include:

Connect access control, visitor management, asset, HR and service desk systems where feasible
Establish a single inventory of cardholder-data locations, media and responsible owners
Capture source, timestamp, location, reviewer and retention information with every evidence item
Use exception workflows with due dates, accountable owners and documented resolution
Protect evidence repositories with least-privilege access, encryption and immutable audit logs
Test provider evidence and physical safeguards at a frequency that matches the risk
Produce assessor-ready reports while retaining the underlying records for validation

The operating rhythm should combine automated collection with human review. A system can identify that a contractor badge remains active, but a facilities owner must determine whether it is an error, an approved exception or a sign that access removal failed. Review decisions, supporting notes and corrective actions become part of the evidence trail.

This approach also helps Australian businesses respond to commercial pressure. Payment service providers, banks and enterprise customers often want assurance before onboarding a supplier. When physical access records, media disposal proof and provider responsibilities are available throughout the year, security teams can support procurement and sales without pausing for a last-minute audit scramble.