Requirement 9: Restrict physical access to cardholder data Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes No N/A CCW 9.5 Are all media physically secured (including but not limited to Review policies and procedures for computers, removable electronic media, paper receipts, physically securing media paper reports, and faxes)? Interview personnel For purposes of Requirement 9, refers to all paper “media” and electronic media containing cardholder data. Is strict control maintained over the internal or external 9.6 Review policies and procedures for distribution of any kind of media? distribution of media Do controls include the following: 9.6.1 Is classified so the sensitivity of the data can be Review policies and procedures for determined? media classification Interview security personnel 9.6.2 Is media sent by secured courier or other delivery method Interview personnel that can be accurately tracked? Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the media Interview personnel (especially when media is distributed to individuals)? Examine media distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility Review policies and procedures of Is all media destroyed when it is no longer needed for 9.8 Review periodic media destruction business or legal reasons? policies and procedures (c) Is media destruction performed as follows: Review periodic media destruction Are hardcopy materials shredded, incinerated, 9.8.1 policies and procedures or pulped so that cardholder data cannot be reconstructed? Interview personnel Observe processes
Requirement 9: Restrict physical access to cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, “media” refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing media Interview personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of media Do controls include the following: 9.6.1 Is classified so the sensitivity of the data can be determined? Review policies and procedures for media classification Interview security personnel 9.6.2 Is media sent by secured courier or other delivery method that can be accurately tracked? Interview personnel Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the media (especially when media is distributed to individuals)? Interview personnel Examine media distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility of Review policies and procedures 9.8 Is all media destroyed when it is no longer needed for business or legal reasons? Review periodic media destruction policies and procedures (c) Is media destruction performed as follows: 9.8.1 Are hardcopy materials shredded, incinerated, or pulped so that cardholder data cannot be reconstructed? Review periodic media destruction policies and procedures Interview personnel Observe processes
cash-pic-saq-b-v3.docx