9.2 Develop procedures to easily distinguish between onsite personnel and visitors, to include:
• Identifying onsite personnel and visitors (for example, assigning badges)
• Changes to access requirements
• Revoking or terminating onsite personnel and expired visitor identification (such as ID badges).
9.2.a Review documented processes to verify that procedures are defined for identifying and distinguishing between onsite personnel and visitors.
• Verify procedures include the following:
• Identifying onsite personnel and visitors (for example, assigning badges),
• Changing access requirements, and
• Revoking terminated onsite personnel and expired visitor identification (such as ID badges)
9.2.b Examine identification methods (such as ID badges) and observe processes for identifying and distinguishing between onsite personnel and visitors to verify that:
• Visitors are clearly identified, and
• It is easy to distinguish between onsite personnel and visitors.
9.2.c Verify that access to the identification process (such as a badge system) is limited to authorized personnel.
Identifying authorized visitors so they are easily distinguished from onsite personnel prevents unauthorized visitors from being granted access to areas containing cardholder data.