Review periodic media destruction Are storage containers used for materials that contain policies and procedures information to be destroyed secured to prevent access to the contents? Examine security of storage containers 9.9 Are devices that capture payment card data via direct physical interaction with the card protected against tampering and substitution as follows? Note: This requirement applies to card-reading devices used in card-present transactions (that is, card swipe or dip) at the point of sale. This requirement is not intended to apply to manual key-entry components such as computer keyboards and POS keypads. Note: Requirement 9.9 is a best practice June 30, 2015, after which it becomes a requirement. Do policies and procedures require that a list of such Review policies and procedures devices be maintained? Do policies and procedures require that devices are Review policies and procedures periodically inspected to look for tampering or substitution? Do policies and procedures require that personnel are Review policies and procedures trained to be aware of suspicious behavior and to report tampering or substitution of devices? Does the list of devices include the following? 9.9.1 Examine the list of devices Make, model of device Location of device (for example, the address of the site or facility where the device is located) Device serial number or method of unique identification Is the list accurate and up to date? Observe devices and device locations and compare to list Is the list of devices updated when devices are Interview personnel relocated, decommissioned, etc.?
Are storage containers used for materials that contain information to be destroyed secured to prevent access to the contents? Review periodic media destruction policies and procedures Examine security of storage containers 9.9 Are devices that capture payment card data via direct physical interaction with the card protected against tampering and substitution as follows? Note: This requirement applies to card-reading devices used in card-present transactions (that is, card swipe or dip) at the point of sale. This requirement is not intended to apply to manual key-entry components such as computer keyboards and POS keypads. Note: Requirement 9.9 is a best practice June 30, 2015, after which it becomes a requirement. Do policies and procedures require that a list of such devices be maintained? Review policies and procedures Do policies and procedures require that devices are periodically inspected to look for tampering or substitution? Review policies and procedures Do policies and procedures require that personnel are trained to be aware of suspicious behavior and to report tampering or substitution of devices? Review policies and procedures 9.9.1 Does the list of devices include the following? Make, model of device Location of device (for example, the address of the site or facility where the device is located) Device serial number or method of unique identification Examine the list of devices Is the list accurate and up to date? Observe devices and device locations and compare to list Is the list of devices updated when devices are relocated, decommissioned, etc.? Interview personnel