Requirement 7: Restrict access to cardholder data by business’ need to know. Requirement 8: Identify and authenticate access to system components. Requirement 9: Restrict physical access to cardholder data.