PCI DSS v4.0.1, Requirement 9

PCI DSS visitor log: what Requirement 9.3.4 asks for, and how long you keep it

You are part way through a self-assessment questionnaire, or an assessor is due, and the question in front of you is about the book at reception. Requirement 9.3.4 lists exactly what a visitor log has to hold and how long it is kept, and 9.3.2 and 9.3.3 say what happens to the visitor in between. All three are quoted below from the standard itself, with what an iPad at the door records towards each line.

Try it yourself, no sign-up

Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.

Book a 15 minute call What 9.3.4 asks

From £150 a month plus VAT, iPad and stand included. We are not assessors or consultants.

What the standard asks

Four lines in 9.3.4, and the three requirements around it

Requirement 9 is about physical access to cardholder data. Section 9.3 is the part about people, and its four sub-requirements are the whole of what the standard says about a visitor between the front door and the way out.

Requirement 9.3.4

The visitor log, and how long you keep it

Visitor logs are used to maintain a physical record of visitor activity both within the facility and within sensitive areas, including: The visitor’s name and the organization represented. The date and time of the visit. The name of the personnel authorizing physical access. Retaining the log for at least three months, unless otherwise restricted by law.

Four things, and the fourth is the one people get wrong from memory. Testing procedure 9.3.4.c has the assessor examine visitor log storage locations and interview responsible personnel to verify that the log is retained for at least three months. The guidance beside it says recording both in and out times is considered a best practice, and that it is good to verify a visitor’s ID matches the name they put on the log.

Requirement 9.3.2

Visitor access to the CDE

Procedures are implemented for authorizing and managing visitor access to the CDE, including: Visitors are authorized before entering. Visitors are escorted at all times. Visitors are clearly identified and given a badge or other identification that expires. Visitor badges or other identification visibly distinguishes visitors from personnel.

Authorised before, escorted throughout, identified as a visitor, and identification that expires. Testing procedures 9.3.2.a to 9.3.2.e have the assessor read the procedure, watch visitors in the CDE, and check the badging system for expiry.

Requirement 9.3.3

Badges handed back

Visitor badges or identification are surrendered or deactivated before visitors leave the facility or at the date of expiration.

The half of the visit a paper book loses most often. The customised approach objective under it reads: visitor identification or badges cannot be reused after expiration.

Requirement 9.3.1

Personnel, kept apart from visitors

Procedures are implemented for authorizing and managing physical access of personnel to the CDE, including: Identifying personnel. Managing changes to an individual’s physical access requirements. Revoking or terminating personnel identification. Limiting access to the identification process or system to authorized personnel.

The same section for your own staff. The guidance beside it says it is important to visually identify the personnel that are physically present, and whether the individual is a visitor or an employee, which is what 9.3.2’s last line asks the badge to do.

Requirement 9, overview

Facility, CDE and sensitive area

These controls often exist outside a CDE or sensitive area, for example a guard desk that identifies, badges, and logs visitors.

The overview separates three areas: sensitive areas, the CDE, and the facility, meaning the physical boundary of a business premise within which CDEs and sensitive areas reside. A reception desk is a facility control. Appendix G defines a visitor as a vendor, guest of any personnel, service worker, or personnel that normally do not have access to the subject area, and says cardholders in a retail location buying goods are not visitors.

Quoted from PCI DSS Requirements and Testing Procedures, version 4.0.1, June 2024, published by PCI Security Standards Council, LLC, read on 26 September 2026. The standard’s own spelling is kept inside the quotations. Nothing in it tells you to buy anything: a paper log with the four fields filled in and a locked drawer to keep it in for three months can satisfy 9.3.4. What paper struggles with is the sign out time, the assessor’s request for one date last quarter, and 9.3.2’s expiring identification.

The record

What the kiosk holds against each line of 9.3.4

Each line below describes what the kiosk’s code does, not what a brochure would like it to. Where the honest answer is a limit, the limit is stated.

Name and organisationThe sign in form asks for the visitor’s name, their company and the person they have come to see, with a vehicle registration if they drove in. Those fields are fixed, so nobody at the desk can skip them.
Date and time, both endsThe sign in time is stamped by the server, not typed. The visitor signs out on the same screen, and the export carries both times or says On site where the second is missing, which is the in and out record the guidance calls a best practice.
Who authorised accessA host is required on every sign in and is stored with the visit, and told by name in Microsoft Teams or Slack. With the badge module, a site that requires approval prints nothing until a named approver enters a PIN on the kiosk, and the badge audit trail records who that was.
Retained for at least three monthsYou set one retention period for the company, anywhere from one day to two years, with a year the default, and records are deleted automatically when it expires. Three months sits inside that range; set the period to at least that, and longer if your own policy or a customer asks for it.
Identified, and distinguished from personnelThe badge module prints the visitor’s name, company, host and the date on a label with a colour band for their clearance, so a visitor is visibly not a member of staff and the date shows when the badge stopped being current. Whether it is surrendered at the door is reception’s job; the record shows when they signed out.
Where it livesIn the European Union, in Ireland, on ISO 27001 certified infrastructure, under a data processing agreement supplied as standard. The security page lists every sub-processor and where each one is.

The visitor history screen filtered to a single day, listing six visitors with their company, host, and sign in and sign out times, beside an Export CSV button — The log filtered to one day: name, company, the host who authorised the visit, and both times. The export contains exactly the rows shown.

The kiosk does not make a site compliant, certified or audit ready. It produces a timestamped record for the requirements named on this page, and the assessor decides what that record is worth.

The visitor management kiosk in full The same record, for an ISO 27001 auditor The book and UK GDPR Our security and sub-processors

On the day

What gets asked, and what you put in front of them

What you are asked	What you show them
Show me your visitor log for a date last quarter.	A filtered, timestamped list on screen in seconds, exported to a file the assessor can keep, with name, company, host, signed in and signed out.
Who authorised this visitor?	The host named on the visit, and where the badge module is in use with approval on, the approver whose PIN released the badge.
How long do you keep the log?	The retention period set on the company, with automatic deletion when it expires. Set it to at least three months and the answer is a number, not a cupboard.
How do you tell a visitor from an employee on the floor?	A printed badge with the name, the host, the date and a colour that says what the wearer is cleared for.
What happens when reception is unstaffed?	The kiosk still captures the arrival and notifies the host directly, so the log does not depend on somebody being at the desk.

9.3.2, made visible

A badge printed only after a named approver’s PIN

The visitor signs in and waits. The host is told, walks over and enters a PIN on the kiosk. No approval, no badge. The colour band and the date on the label are what distinguishes a visitor from personnel on the floor.

The badge module is an add-on at £150 a month plus VAT, label printer included. The platform works without it. The player loads from YouTube only when you press play; nothing is sent to Google before that. What happens when you do.

Before you ask

The questions sites with a cardholder data environment ask

How long must a PCI DSS visitor log be kept?

Requirement 9.3.4 of PCI DSS v4.0.1 says the log is retained for at least three months, unless otherwise restricted by law. Testing procedure 9.3.4.c has the assessor examine where the logs are stored to verify that. Three months is a floor, not a target: most sites keep longer to cover their own investigations and their customers’ questions, and UK GDPR asks that whatever period you choose is one you can justify and keep to. The kiosk’s retention setting runs from one day to two years.

Does the visitor log have to be on paper?

The requirement’s words are a physical record of visitor activity, which describes what is recorded rather than the medium, and the testing procedure examines visitor log storage locations, which a dashboard and an exported file both are. Electronic visitor logs are common in assessed environments. What your assessor accepts is their decision, and it is worth asking them before the visit rather than during it.

Which version of PCI DSS is current?

Version 4.0.1, dated June 2024, is the document this page quotes and the one the Council’s document library serves. The requirement numbers here are as printed in it. If your assessor is working from a different version, check the numbers against that copy; 9.3.4 in v4.0.1 is the visitor log requirement.

Who counts as a visitor?

Appendix G of v4.0.1 defines a visitor as a vendor, guest of any personnel, service worker, or personnel that normally do not have access to the subject area, and adds that cardholders present in a retail location to purchase goods or services are not considered visitors. So an engineer, an auditor and a member of staff from another site are all visitors at the CDE; a customer in the shop is not.

Does the kiosk record the name of the person who authorised access?

Every sign in requires a host, and the host is stored with the visit and told by name the moment the visitor arrives. Where the badge module is in use and the site requires approval, nothing prints until a named approver enters a PIN on the kiosk, and the badge’s audit trail records the approver. Whether the host or the approver is the personnel authorizing physical access in 9.3.4’s sense is a question for your procedure and your assessor.

Does the badge expire?

A printed badge carries the date it was issued, so a badge from last week is visibly not today’s, and the record shows when the visitor signed out. It is a paper label and cannot be deactivated, so surrendering it at the door under 9.3.3 is a job for reception. The badge module is an add-on at £150 a month plus VAT, label printer included, and the platform’s visitor log works without it.

Being straight with you

What this does not do

We are not a Qualified Security Assessor, not the PCI Security Standards Council and not a compliance consultancy. This is general information about a published standard, not assessment advice.
Requirement 9 is one of twelve, and 9.3 is one section of it. Which requirements your SAQ includes is set by the SAQ Instructions and Guidelines document, and the scope of your cardholder data environment is yours to define.
The kiosk lives at reception, which the standard calls a facility control. It does not control doors to sensitive areas, does not monitor entry and exit points with cameras or access control mechanisms as 9.2.1.1 asks, and does not badge your own personnel.
It does not check a visitor’s ID against the name they gave. The guidance says that is good practice, and it stays a job for the person at the desk.
A paper badge cannot be deactivated. The record shows when the visitor signed out and the badge shows its date; collecting it is reception’s job.
If your assessor has raised a specific finding, bring their wording to the call and we will tell you honestly whether this closes it.

Sources

Check any of this yourself

PCI Security Standards Council, document library: PCI DSSWhere PCI DSS v4.0.1, June 2024, is published. The Council asks you to accept a licence agreement before the PDF opens. Requirement 9 starts on page 210 and 9.3.4 is on page 219. Quoted from the Council’s PDF, read 26 September 2026.
PCI SSC, SAQ Instructions and GuidelinesWhich requirements each self-assessment questionnaire includes. Whether Requirement 9 is in yours is answered there, not here.

General information about a published standard, not assessment advice. Requirement numbers move between versions; confirm against your own copy.

Also asked of sites like yours

The other things somebody may ask you to evidence

Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.

Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.

Advise sites on this standard? Referral terms are on one page.

Next step

Bring your assessor’s wording to the call

Fifteen minutes on the phone. Read us the requirement you have been asked about, or the SAQ question in front of you, and we will tell you straight whether a kiosk produces the record it asks for.

Book a 15 minute call

No site visit needed and nothing to install. If it is not a fit we will say so on the call.

Would rather email? [email protected]

Not the person who signs it off? Send them the one page business case