Requirement 9: Restrict physical access to cardholder data Response (Check one response for each PCI DSS Question Expected Testing question) Yes with Yes CCW No N/A 9.1 Are appropriate facility entry controls in place to limit Observe physical access controls and monitor physical access to systems in the Observe personnel cardholder data environment? 9.5 Are all media physically secured (including but not Review policies and procedures for limited to computers, removable electronic media, physically securing media paper receipts, paper reports, and faxes)? Interview personnel For purposes of Requirement 9, refers to all paper and electronic media containing cardholder data. Is strict control maintained over the internal or 9.6 Review policies and procedures for external distribution of any kind of media? distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be Review policies and procedures for determined? media classification Interview security personnel 9.6.2 Is sent by secured courier or other delivery method Interview personnel that can be accurately tracked? Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the Interview personnel media (especially when media is distributed to Examine media distribution tracking individuals)? logs and documentation 9.7 Is strict control maintained over the storage and Review policies and procedures accessibility of media? Is all media destroyed when it is no longer needed 9.8 Review periodic media destruction for business or legal reasons? policies and procedures (c) Is media destruction performed as follows:
Requirement 9: Restrict physical access to cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 9.1 Are appropriate facility entry controls in place to limit and monitor physical access to systems in the cardholder data environment? Observe physical access controls Observe personnel 9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing media Interview personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be determined? Review policies and procedures for media classification Interview security personnel 9.6.2 Is sent by secured courier or other delivery method that can be accurately tracked? Interview personnel Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the media (especially when media is distributed to individuals)? Interview personnel Examine media distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility of media? Review policies and procedures 9.8 Is all media destroyed when it is no longer needed for business or legal reasons? Review periodic media destruction policies and procedures (c) Is media destruction performed as follows:
PCI-DSS-v3_2-SAQ-A_EP.docx