Which items require restricted physical access as per PCI DSS requirements?

Which items require restricted physical access as per PCI DSS requirements?

• A. Public signage
• B. Wireless access points, gateways, handheld devices, networking/communications hardware, and telecommunication lines
• C. Lobbies and hallways
• D. Only servers

Answer: (B)

Physical access controls are required for devices that store, process, or transmit cardholder data. PCI DSS asks to restrict who can physically touch or access those components to prevent tampering, theft, or unauthorized interception of data. The best answer points to items that are directly involved in the network that supports the Cardholder Data Environment: wireless access points, gateways, handheld devices, networking/communications hardware, and telecommunication lines. These components are susceptible to physical compromise if left in accessible or unmanaged spaces, so they must be protected with controlled access, tamper-evident measures, and proper handling procedures. Public signage and open areas like lobbies or hallways are not themselves devices that store or transmit cardholder data, so they don’t fall under the restricted-access requirement in the same way. Limiting the scope to servers is too narrow, because other critical network and endpoint devices also reach or touch the CDE and require the same level of physical protection.

Physical access controls are required for devices that store, process, or transmit cardholder data. PCI DSS asks to restrict who can physically touch or access those components to prevent tampering, theft, or unauthorized interception of data.

The best answer points to items that are directly involved in the network that supports the Cardholder Data Environment: wireless access points, gateways, handheld devices, networking/communications hardware, and telecommunication lines. These components are susceptible to physical compromise if left in accessible or unmanaged spaces, so they must be protected with controlled access, tamper-evident measures, and proper handling procedures.

Public signage and open areas like lobbies or hallways are not themselves devices that store or transmit cardholder data, so they don’t fall under the restricted-access requirement in the same way. Limiting the scope to servers is too narrow, because other critical network and endpoint devices also reach or touch the CDE and require the same level of physical protection.