Free guide · PCI DSS v4.0.1

PCI DSS Requirement 9.5.1 — Protecting POI devices from tampering

Requirement 9.5.1 protects point-of-interaction devices that capture card data through direct physical interaction. It requires an up-to-date device list, periodic inspection of device surfaces for tampering or substitution, and personnel trained to spot and report suspicious behaviour.Timing: Applies in PCI DSS v4.0.1 and is assessed at every annual assessment.

Find your SAQ All guides

Who it applies to

Any merchant with card-present POI terminals, including standalone terminals

SAQ B, SAQ B-IP, SAQ C-VT, SAQ P2PE and SAQ SPoC merchants

What Requirement 9.5.1 asks for

Paraphrased from PCI DSS v4.0.1. Read the standard itself for the authoritative wording and testing procedures.

An up-to-date list of POI devices is maintained, with make, model, location and serial number or other unique identifier.

POI device surfaces are periodically inspected to detect tampering and unauthorised substitution.

The inspection frequency is defined in a targeted risk analysis performed per Requirement 12.3.1.

Personnel are trained to be aware of suspicious behaviour and to report tampering or substitution.

Evidence an assessor expects

The POI device register with serial numbers and locations

Completed inspection logs covering the assessment period

The targeted risk analysis behind the inspection frequency

Training records and the reporting procedure staff are told to follow

Common mistakes

A device register that was accurate at rollout and never reconciled after swaps or repairs.

Inspections performed but not recorded, which leaves the control unevidenced.

Assuming a P2PE solution removes the inspection obligation — the P2PE Instruction Manual still requires it.

Not sure whether Requirement 9.5.1 is in your scope?

Which requirements you must answer depends on the SAQ that applies to your environment. The free SAQ selector walks the official PCI SSC decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Paraphrased from PCI DSS v4.0.1 (PCI Security Standards Council). Independent summary; not endorsed by PCI SSC. Refer to the PCI SSC Document Library for the authoritative standard.