Which device-list detail is explicitly required by 9.9.1?

• A. Make, model, location, and serial number
• B. Color and size of the device
• C. Purchase date
• D. Warranty status

Answer: (A)

Maintaining an accurate, auditable list of every device that processes, stores, or transmits cardholder data is essential. For this control, the list should include identifying details that let you uniquely recognize and manage each device: the make, model, location, and serial number. These details enable precise tracking, assignment, and replacement if needed, and they support security activities like inventory verification and incident response.

Details like color and size don’t help identify or manage devices in a PCI DSS context, and purchase date or warranty status aren’t required by this requirement. The key goal is to know exactly which devices exist, where they are, and how to uniquely identify them for ongoing governance and risk management.