WithPCI Logo
WithPCI.com
Original requirement from PCI DSS v4.0.1

# 9.5.1.1 An up-to-date list of POI devices is maintained, including:

Defined Approach Requirements

9.5.1.1 An up-to-date list of POI devices is maintained, including:

  • Make and model of the device.
  • Location of device.
  • Device serial number or other methods of unique identification.

Defined Approach Testing Procedures

9.5.1.1.a Examine the list of POI devices to verify it includes all elements specified in this requirement.

9.5.1.1.b Observe POI devices and device locations and compare to devices in the list to verify that the list is accurate and up to date.

9.5.1.1.c Interview personnel to verify the list of POI devices is updated when devices are added, relocated, decommissioned, etc.

Customized Approach Objective

The identity and location of POI devices is recorded and known at all times.

Purpose

Keeping an up-to-date list of POI devices helps an organization track where devices are supposed to be and quickly identify if a device is missing or lost.

Good Practice

The method for maintaining a list of devices may be automated (for example, a device-management system) or manual (for example, documented in electronic or paper records). For on-the-road devices, the location may include the name of the personnel to whom the device is assigned.

Examples

Methods to maintain device locations include identifying the address of the site or facility where the device is located.

purpose

Maintain a list of all POI devices.

compliance strategies

  • Centralized device inventory
  • Regular updates

typical policies

  • POI Device Inventory Policy

common pitfalls

  • Outdated device lists
  • Unregistered devices

type

Documentation/Process Control

difficulty

Low

key risks

  • Unmonitored devices vulnerable to tampering

recommendations

  • Automated device tracking systems

Eligible SAQ

  • SAQ-B
  • SAQ-B-IP
  • SAQ-C
  • SAQ-D MERCHANT
  • SAQ-D SERVICE PROVIDER

Your perspective on this PCI DSS requirement matters! Share your implementation experiences, challenges, or questions below. Your insights help other organizations improve their compliance journey and build a stronger security community.Comment Policy