Every security policy and operational procedure called for under Requirement 9 (physical access, visitor handling, media protection and point-of-interaction device protection) must meet four conditions: it is written down; it is kept current; it is actually followed in daily operation; and every affected party knows about it. The guidance (not the requirement) suggests revising these documents soon after a change in processes, technology or business goals instead of only on a periodic cycle. Applicability: all entities assessed against PCI DSS. Customized approach objective: personnel understand and follow the expectations, controls and oversight for Requirement 9 activities, and those activities run in a repeatable, consistent way that reflects management intent.
This control maps to 43 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
You are reading one control. How much of PCI DSS 4.0 have you already done?
PCI DSS 4.0 9.1.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.