(c) Is media destruction performed as follows: Are hardcopy materials cross-cut shredded, 9.8.1 Review periodic media destruction incinerated, or pulped so that cardholder data policies and procedures cannot be reconstructed? Interview personnel Observe processes Are storage containers used for materials that Examine security of storage contain information to be destroyed secured to containers prevent access to the contents? 9.9 Are devices that capture payment card data via direct physical interaction with the card protected against tampering and substitution as follows? Note: This requirement applies to card-reading devices used in card-present transactions (that is, card swipe or dip) at the point of sale. This requirement is not intended to apply to manual key-entry components such as computer keyboards and POS keypads. Do policies and procedures require that a list of Review policies and procedures such devices be maintained? Do policies and procedures require that devices are Review policies and procedures periodically inspected to look for tampering or substitution? Do policies and procedures require that personnel Review policies and procedures are trained to be aware of suspicious behavior and to report tampering or substitution of devices? Does the list of devices include the following? 9.9.1 Examine the list of devices Make, model of device Location of device (for example, the address of the site or facility the device is located) Device serial number or other method of unique identification Is the list accurate and up to date? Observe devices and device locations and compare to list
(c) Is media destruction performed as follows: 9.8.1 Are hardcopy materials cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed? Review periodic media destruction policies and procedures Interview personnel Observe processes Are storage containers used for materials that contain information to be destroyed secured to prevent access to the contents? Examine security of storage containers 9.9 Are devices that capture payment card data via direct physical interaction with the card protected against tampering and substitution as follows? Note: This requirement applies to card-reading devices used in card-present transactions (that is, card swipe or dip) at the point of sale. This requirement is not intended to apply to manual key-entry components such as computer keyboards and POS keypads. Do policies and procedures require that a list of such devices be maintained? Review policies and procedures Do policies and procedures require that devices are periodically inspected to look for tampering or substitution? Review policies and procedures Do policies and procedures require that personnel are trained to be aware of suspicious behavior and to report tampering or substitution of devices? Review policies and procedures 9.9.1 Does the list of devices include the following? Make, model of device Location of device (for example, the address of the site or facility the device is located) Device serial number or other method of unique identification Examine the list of devices Is the list accurate and up to date? Observe devices and device locations and compare to list
SAQ_B-IP.docx