(c) Is media destruction performed as follows: Review periodic media Are hardcopy materials cross-cut shredded, 9.8. 1 destruction policies and incinerated, or pulped so that cardholder data cannot procedures be reconstructed? Interview personnel Observe processes Review periodic media Are storage containers used for materials that contain destruction policies and information to be destroyed secured to prevent access procedures to the contents? Examine security of storage containers 9. 9 Are devices that capture payment card data via direct physical interaction with the card protected against tampering and substitution as follows? Note: This requirement applies to card-reading devices used in card-present transactions (that is, card swipe or dip) at the point of sale. This requirement is not intended to apply to manual key-entry components such as computer keyboards and POS keypads. Do policies and procedures require that a list of such Review policies and procedures devices be maintained? [Business Affairs keeps a master list of POS devices using information provided by merchants. Please keep a local list as well and inform Business Affairs when device changes are made.] Do policies and procedures require that devices are Review policies and procedures periodically inspected to look for tampering or substitution?
(c) Is media destruction performed as follows: 9.8. 1 Are hardcopy materials cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed? Review periodic media destruction policies and procedures Interview personnel Observe processes Are storage containers used for materials that contain information to be destroyed secured to prevent access to the contents? Review periodic media destruction policies and procedures Examine security of storage containers 9. 9 Are devices that capture payment card data via direct physical interaction with the card protected against tampering and substitution as follows? Note: This requirement applies to card-reading devices used in card-present transactions (that is, card swipe or dip) at the point of sale. This requirement is not intended to apply to manual key-entry components such as computer keyboards and POS keypads. Do policies and procedures require that a list of such devices be maintained? Review policies and procedures [Business Affairs keeps a master list of POS devices using information provided by merchants. Please keep a local list as well and inform Business Affairs when device changes are made.] Do policies and procedures require that devices are periodically inspected to look for tampering or substitution? Review policies and procedures
saq_b_v3_1_instr.docx