c9.2 Manage the physical scope of your own components (hybrid/POI)
Where physical media or point-of-interaction (POI) devices exist outside AWS under customer responsibility, apply and document the media protection and POI device controls.
Requirement 9
Restrict Physical Access to Cardholder Data
PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.
9.4 Media with cardholder data is securely stored, accessed, distributed, and destroyed
- 9.4.1 All media with CHD physically secured Out of scope
- 9.4.1.1 Offline media backups stored in secure location Out of scope
- 9.4.1.2 Security of offline media storage locations reviewed Out of scope
- 9.4.2 All media classified by data sensitivity Your responsibility
- 9.4.3 Media sent outside facility secured and logged Out of scope
- 9.4.4 Management approval for media moved outside facility Out of scope
- 9.4.5 Inventory logs of electronic media with CHD maintained Your responsibility
- 9.4.5.1 Media inventories conducted at least annually Your responsibility
- 9.4.6 Hard-copy materials with CHD destroyed when no longer needed Out of scope
- 9.4.7 Electronic media with CHD rendered unrecoverable on disposal Covered
9.5 Point-of-interaction (POI) devices are protected from tampering and unauthorized substitution
- 9.5.1 POI devices protected from tampering and unauthorized substitution Out of scope
- 9.5.1.1 Up-to-date list of POI devices maintained Out of scope
- 9.5.1.2 POI device surfaces periodically inspected Out of scope
- 9.5.1.2.1 Frequency of POI inspections defined by targeted risk analysis Your responsibility
- 9.5.1.3 Training for personnel in POI environments Your responsibility
How to implement on AWS
Formally document whether any of your own media or POI devices exist; if they do not apply in a 100% AWS deployment, record the non-applicability in scope. For hybrid components, maintain a POI inventory, periodic tamper inspections, and secure media destruction procedures. Link the evidence to the PCI scope documentation.
Practical implementation
How this control is implemented in each reference architecture:
For a pure AWS deployment the tactical work is documenting non-applicability of your own media/POI, or managing any hybrid devices that do exist.
- Confirm whether any customer-owned media or point-of-interaction (POI) devices are in scope; a 100% AWS deployment usually has none.
- If none apply, record the non-applicability of 9.4 (media) and 9.5 (POI) with rationale in the PCI scope document.
- If hybrid POI/media exist, maintain a POI inventory, periodic tamper-inspection records, and secure media-destruction procedures, and link them to scope.
How to validate: The scope document states 9.4/9.5 applicability with rationale; where devices exist, the POI inventory and inspection records are current.
Avoid: Skipping 9.4/9.5 silently because 'it's all in AWS'. Record the non-applicability explicitly with rationale, an assessor needs it on file.
Decide media/POI applicability once at the org level, and where hybrid environments exist, track them in the relevant account against the shared matrix.
- Document media/POI non-applicability once at the organization level so every CDE account inherits a consistent position.
- Where hybrid POI environments exist, track their inventory and inspections in the relevant workload account.
- Reference the shared-responsibility matrix so physical scope is unambiguous across the PCI OU.Org-level evidence store
Amazon S3
How to validate: The org-level scope document addresses 9.4/9.5, and any hybrid POI environment has current inventory/inspection records referenced from the matrix.
Avoid: Documenting media/POI applicability inconsistently per account. Decide it once at the org level and track exceptions where they actually exist.
PCI validation
Testing procedures
- Examine documentation to verify procedures physically secure, classify, inventory, and securely destroy media with cardholder data (9.4.1, 9.4.2, 9.4.5.a, 9.4.6.a, 9.4.7.a), or document non-applicability for AWS-only deployments.
- Examine the POI device list and inspection procedures to verify devices are inventoried and periodically inspected for tampering and substitution (9.5.1.1.a, 9.5.1.2.a), or document non-applicability.
Evidence in AWS
- PCI scope document indicating applicability or non-applicability of physical media and POI.
- Where applicable: POI inventory, inspection records, and media destruction procedures.
- Shared responsibility matrix delimiting what AWS covers.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 9.4 — Media with cardholder data cannot be accessed by unauthorized personnel and is securely destroyed when no longer needed.
- 9.5 — Point-of-interaction (POI) devices are protected from tampering and unauthorized substitution.
AWS services
AWS Artifact Learning resources
References
- PCI DSS v4.0.1 Requirements 9.4, 9.5 (customer responsibility for hybrid/POI)