Are hardcopy materials cross-cut shredded, 9.8.1 Review periodic media destruction incinerated, or pulped so that cardholder data policies and procedures cannot be reconstructed? Interview personnel Observe processes Are storage containers used for materials that Review periodic media destruction contain information to be destroyed secured to policies and procedures prevent access to the contents? Examine security of storage containers Regularly Monitor and Test Networks Requirement 11: Regularly test security systems and processes Response one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A 11.3.4 If segmentation is used to isolate the CDE from other networks: (a) Are penetration-testing procedures defined to test all Examine segmentation controls segmentation methods, to confirm they are operational Review penetration-testing and effective, and isolate all out-of-scope systems from methodology systems in the CDE?
9.8.1 Are hardcopy materials cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed? Review periodic media destruction policies and procedures Interview personnel Observe processes Are storage containers used for materials that contain information to be destroyed secured to prevent access to the contents? Review periodic media destruction policies and procedures Examine security of storage containers Regularly Monitor and Test Networks Requirement 11: Regularly test security systems and processes PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 11.3.4 If segmentation is used to isolate the CDE from other networks: (a) Are penetration-testing procedures defined to test all segmentation methods, to confirm they are operational and effective, and isolate all out-of-scope systems from systems in the CDE? Examine segmentation controls Review penetration-testing methodology