For personnel working from home, is their environment considered a “sensitive area” for PCI DSS?

PCI DSS 3.2.1 PCI today 90 96 4

Background
share close

An individual’s private work-from-home (WFH) environment is not considered a “sensitive area,” and personnel working from home are not required to meet PCI DSS Requirements 9.1.1 or 9.3 for their WFH environments.

“Personnel working from home”

Refers to individuals that are employed by an entity to perform business duties from the individual’s private residence; this does not include individuals running their own home-based business.


A sensitive area is typically a subset of the cardholder data environment (CDE) and is any area that houses systems considered critical to the CDE.

This includes data centers, server rooms, back-office rooms at retail locations, and any area that concentrates or aggregates cardholder or account data storage, processing, or transmission. Sensitive areas also include areas housing systems that manage or maintain the security of the CDE (for example, those providing network security or that manage physical or logical security).

As a WFH environment is not considered a sensitive area, it is not expected that video cameras and/or access control mechanisms are in place to monitor or physically restrict access within these environments.

Personnel working from home are expected to adhere to their organization’s security policies and procedures, including limiting access to cardholder data within their  WFH environments.

For example, using only company-authorized devices to access cardholder data, locking computer screens when stepping away from the computer, securing any storage of paper copies of cardholder data to prevent unauthorized access, and following the organization’s policies for securing network and computer equipment used at home for work purposes.

Written by: PCI

Tagged as: , , , , , , , , , .

Rate it
Previous post
EN