Is there a periodic media destruction policy that Review periodic media destruction defines requirements for the following? policies and procedures Hard-copy materials must be crosscut shredded, incinerated, or pulped such that there is reasonable assurance the hard-copy materials cannot be reconstructed. Storage containers used for materials that are to be destroyed must be secured. Cardholder data on electronic media must be rendered unrecoverable (e.g. via a secure wipe program in accordance with industry-accepted standards for secure deletion, or by physically destroying the media). Is destruction performed as follows: 9.8.1 Are hardcopy materials cross-cut shredded, Interview personnel incinerated, or pulped so that cardholder data cannot Examine procedures be reconstructed? Observe processes Are storage containers used for materials that Examine security of storage contain information to be destroyed secured to containers prevent access to the contents? 9.8.2 Is cardholder data on electronic rendered Observe processes unrecoverable (e.g. via a secure wipe program in Interview personnel accordance with industry-accepted standards for secure deletion, or otherwise by physically destroying the media), so that cardholder data cannot be reconstructed?
Is there a periodic media destruction policy that defines requirements for the following? Hard-copy materials must be crosscut shredded, incinerated, or pulped such that there is reasonable assurance the hard-copy materials cannot be reconstructed. Storage containers used for materials that are to be destroyed must be secured. Cardholder data on electronic media must be rendered unrecoverable (e.g. via a secure wipe program in accordance with industry-accepted standards for secure deletion, or by physically destroying the media). Review periodic media destruction policies and procedures Is destruction performed as follows: 9.8.1 Are hardcopy materials cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed? Interview personnel Examine procedures Observe processes Are storage containers used for materials that contain information to be destroyed secured to prevent access to the contents? Examine security of storage containers 9.8.2 Is cardholder data on electronic rendered unrecoverable (e.g. via a secure wipe program in accordance with industry-accepted standards for secure deletion, or otherwise by physically destroying the media), so that cardholder data cannot be reconstructed? Observe processes Interview personnel
PCI_DSS_v3-1_SAQ_D_Merchant_rev1-1.docx