8.5 Are group, shared, or generic accounts, passwords, or Review policies and procedures other authentication methods prohibited as follows: Examine user ID lists Generic user IDs and accounts are disabled or Interview personnel removed; Shared user IDs for system administration activities and other critical functions do not exist; and Shared and generic user IDs are not used to administer any system components? Requirement 9: Restrict physical access to cardholder data Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A 9.5 Are all media physically secured (including but not Review policies and procedures for limited to computers, removable electronic media, physically securing media paper receipts, paper reports, and faxes)? Interview personnel For purposes of Requirement 9, refers to all “media” paper and electronic media containing cardholder data. Is strict control maintained over the internal or 9.6 Review policies and procedures for external distribution of any kind of media? distribution of media Do controls include the following:
8.5 Are group, shared, or generic accounts, passwords, or other authentication methods prohibited as follows: Generic user IDs and accounts are disabled or removed; Shared user IDs for system administration activities and other critical functions do not exist; and Shared and generic user IDs are not used to administer any system components? Review policies and procedures Examine user ID lists Interview personnel Requirement 9: Restrict physical access to cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, “media” refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing media Interview personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of media Do controls include the following: