9.5 Are all media physically secured (including but not limited Review policies and procedures for to computers, removable electronic media, paper physically securing receipts, paper reports, and faxes)? Interview personnel For purposes of Requirement 9, refers to all paper and electronic media containing cardholder data. Is strict control maintained over the internal or 9.6 Review policies and procedures for external distribution of any kind of media? distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be Review policies and procedures for determined? classification Interview security personnel 9.6.2 Is media sent by secured courier or other delivery Interview personnel method that can be accurately tracked? Examine distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the Interview personnel media (especially when media is distributed to Examine distribution tracking individuals)? logs and documentation 9.7 Is strict control maintained over the storage and Review policies and procedures accessibility of media? Is all media destroyed when it is no longer needed 9.8 Review periodic media destruction for business or legal reasons? policies and procedures (c) Is destruction performed as follows: Review periodic media destruction Are hardcopy materials cross-cut shredded, 9.8.1 policies and procedures incinerated, or pulped so that cardholder data cannot be reconstructed? Interview personnel Observe processes
9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing Interview personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be determined? Review policies and procedures for classification Interview security personnel 9.6.2 Is media sent by secured courier or other delivery method that can be accurately tracked? Interview personnel Examine distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the media (especially when media is distributed to individuals)? Interview personnel Examine distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility of media? Review policies and procedures 9.8 Is all media destroyed when it is no longer needed for business or legal reasons? Review periodic media destruction policies and procedures (c) Is destruction performed as follows: 9.8.1 Are hardcopy materials cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed? Review periodic media destruction policies and procedures Interview personnel Observe processes
pci-dss-v3_2-saq-c-rev1_1.docx