Is the visitor log retained for at least three months? Review policies and procedures Examine visitor log retention 9.5 Are all media physically secured (including but not Review policies and procedures limited to computers, removable electronic media, paper for physically securing media receipts, paper reports, and faxes)? Interview personnel For purposes of Requirement 9, refers to all “media” paper and electronic media containing cardholder data. Is the location where media back-ups are stored 9.5.1 Review policies and procedures reviewed at least annually to confirm storage is secure? for reviewing offsite media locations Interview security personnel Is strict control maintained over the internal or 9.6 Review policies and procedures external distribution of any kind of media? for distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be Review policies and procedures determined? for media classification Interview security personnel 9.6.2 Is media sent by secured courier or other delivery Interview personnel method that can be accurately tracked? Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the Interview personnel media (especially when media is distributed to Examine media distribution individuals)? tracking logs and documentation 9.7 Is strict control maintained over the storage and Review policies and procedures accessibility of media? Are inventory logs of all media properly maintained? 9.7.1 Examine inventory logs
Is the visitor log retained for at least three months? Review policies and procedures Examine visitor log retention 9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, “media” refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing media Interview personnel 9.5.1 Is the location where media back-ups are stored reviewed at least annually to confirm storage is secure? Review policies and procedures for reviewing offsite media locations Interview security personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be determined? Review policies and procedures for media classification Interview security personnel 9.6.2 Is media sent by secured courier or other delivery method that can be accurately tracked? Interview personnel Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the media (especially when media is distributed to individuals)? Interview personnel Examine media distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility of media? Review policies and procedures 9.7.1 Are inventory logs of all media properly maintained? Examine inventory logs
PCI-DSS-v3_2-SAQ-D_Merchant.docx