9 Restrict physical access to cardholder data All items in requirement 9 may be controlled by business procedures and policy. With the proper business controls in place, OpenBSD is compliant with requirement 9.