9 Restrict physical access to cardholder data All items in requirement 9 may be controlled by business procedures and policy. With the proper business controls in place, Debian GNU/Linux 5.0 (Lenny) is compliant with requirement 9.