PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/158 of 250
9.4.6Media with cardholder data is securely stored, accessed, distributed, and destroyed
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
Hard-copy materials with cardholder data are destroyed when no longer needed for business or legal reasons, as follows:
- Materials are cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed.
- Materials are stored in secure storage containers prior to destruction.
Defined Approach Testing Procedures:
9.4.6.a Examine the periodic media destruction policy to verify that procedures are defined to destroy hard-copy media with cardholder data when no longer needed for business or legal reasons in accordance with all elements specified in this requirement.
9.4.6.b Observe processes and interview personnel to verify that hard-copy materials are cross-cut shredded, incinerated, or pulped such that cardholder data cannot be reconstructed.
9.4.6.c Observe storage containers used for materials that contain information to be destroyed to verify that the containers are secure.