# 9.5.1.1 An up-to-date list of POI devices is maintained, including:
Defined Approach Requirements
9.5.1.1 An up-to-date list of POI devices is maintained, including:
- Make and model of the device.
- Location of device.
- Device serial number or other methods of unique identification.
Defined Approach Testing Procedures
9.5.1.1.a Examine the list of POI devices to verify it includes all elements specified in this requirement.
9.5.1.1.b Observe POI devices and device locations and compare to devices in the list to verify that the list is accurate and up to date.
9.5.1.1.c Interview personnel to verify the list of POI devices is updated when devices are added, relocated, decommissioned, etc.
Customized Approach Objective
The identity and location of POI devices is recorded and known at all times.
Purpose
Keeping an up-to-date list of POI devices helps an organization track where devices are supposed to be and quickly identify if a device is missing or lost.
Good Practice
The method for maintaining a list of devices may be automated (for example, a device-management system) or manual (for example, documented in electronic or paper records). For on-the-road devices, the location may include the name of the personnel to whom the device is assigned.
Examples
Methods to maintain device locations include identifying the address of the site or facility where the device is located.
purpose
Maintain a list of all POI devices.
compliance strategies
- Centralized device inventory
- Regular updates
typical policies
- POI Device Inventory Policy
common pitfalls
- Outdated device lists
- Unregistered devices
type
Documentation/Process Control
difficulty
Low
key risks
- Unmonitored devices vulnerable to tampering
recommendations
- Automated device tracking systems
Eligible SAQ
- SAQ-B
- SAQ-B-IP
- SAQ-C
- SAQ-D MERCHANT
- SAQ-D SERVICE PROVIDER
Your perspective on this PCI DSS requirement matters! Share your implementation experiences, challenges, or questions below. Your insights help other organizations improve their compliance journey and build a stronger security community.Comment Policy