9.1.2 Are physical and/or logical controls in place to restrict Review policies and procedures access to publicly accessible network jacks? Interview personnel For example, network jacks located in public areas and Observe locations areas accessible to visitors could be disabled and only enabled when network access is explicitly authorized. Alternatively, processes could be implemented to ensure that visitors are escorted at all times in areas with active network jacks. 9.5 Are all media physically secured (including but not limited Review policies and procedures for to computers, removable electronic media, paper physically securing media receipts, paper reports, and faxes)? Interview personnel For purposes of Requirement 9, refers to all “media” paper and electronic media containing cardholder data. Is strict control maintained over the internal or 9.6 Review policies and procedures for external distribution of any kind of media? distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be Review policies and procedures for determined? classification Interview security personnel 9.6.2 Is sent by secured courier or other delivery method Interview personnel that can be accurately tracked? Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the Interview personnel media (especially when media is distributed to Examine media distribution tracking individuals)? logs and documentation 9.7 Is strict control maintained over the storage and Review policies and procedures accessibility of media? Is all media destroyed when it is no longer needed for 9.8 Review periodic media destruction business or legal reasons? policies and procedures (c) Is media destruction performed as follows:
9.1.2 Are physical and/or logical controls in place to restrict access to publicly accessible network jacks? For example, network jacks located in public areas and areas accessible to visitors could be disabled and only enabled when network access is explicitly authorized. Alternatively, processes could be implemented to ensure that visitors are escorted at all times in areas with active network jacks. Review policies and procedures Interview personnel Observe locations 9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, “media” refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing media Interview personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be determined? Review policies and procedures for classification Interview security personnel 9.6.2 Is sent by secured courier or other delivery method that can be accurately tracked? Interview personnel Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the media (especially when media is distributed to individuals)? Interview personnel Examine media distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility of media? Review policies and procedures 9.8 Is all media destroyed when it is no longer needed for business or legal reasons? Review periodic media destruction policies and procedures (c) Is media destruction performed as follows: