Frequently Asked Questions

< Back to search page

Are point-of-sale devices required to be physically secured (e.g. with a cable or tether) to prevent removal or substitution in order to meet PCI DSS Requirement 9.9?

FAQ Response

No, PCI DSS Requirement 9.9 does not require devices to be fixed in place or physically attached to a surface.  Requirement 9.9 and its three sub-requirements address three areas of device security:

  1. Maintaining an up-to-date list of devices
  2. Periodically inspecting devices to detect tampering or replacement, and
  3. Providing training for personnel to be aware of suspicious behavior and detect attempts to tamper with or replace devices

It should also be noted that Requirement 9.9 applies only to card-reading devices (that is, where the card is physically swiped or dipped) at the point of sale. The requirement is also recommended, but is not required, for manual key-entry components such as computer keyboards and POS keypads.

Requirement 9.9 is a best practice until 30 June 2015, after which it becomes a requirement.

June 2014
Article Number 1281