PCI DSS 4.0 9.2.1: 9.2.1 Facility entry controls for CDE systems
The entity must operate suitable facility entry controls that limit physical access to systems within the cardholder data environment. The guidance gives examples such as controls at each data center, computer room and other location holding CDE systems, badge readers, or lock and key backed by a current register of key holders, and advises that whichever mechanism is chosen be sufficient for the organization to confirm only authorized people gain entry. Applicability: does not cover locations that are open to consumers (cardholders). Customized approach objective: people without authorization are unable to physically reach CDE system components.
This control maps to 50 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
You are reading one control. How much of PCI DSS 4.0 have you already done?
PCI DSS 4.0 9.2.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.