[Autogenerated] where the last requirement was pretty light on detail.
This next one requirement 9.6,
which is concerned with the distribution of physical
media containing cardholder data, is much more prescriptive.
The main requirement is tough procedures and processes so that people know
what to do and how they should move physical media containing cardholder data
within the organization and externally outside of the organization and
typically the sort of things that this requirement applies to his backup
tapes being moved off site storage, hard disk containing cardholder data.
And those are this may or may not be actually in a physical system on finally
paperwork with cardholder data written or printed on it.
This level, the QoS, is just looking to validate those policies and procedures.
Then each of the three sub requirements have more
detailed tests for the QoS A to carry out.
The first of requirement is that media needs to be classified,
in other words,
that the organization formally recognizes that media containing cardholder
data is confidential and so demanding of more protection.
The media that doesn't contain cardholder data,
the standards really clear that this requirement doesn't mean
that any media containing cardholder data has to have a physical
label is taxi with is says confidential or top secret or steal
me for cardholder data.
This is not a requirement that media is marked, just that it's classified.
This requirements caused lots of confusion in the past,
with QoS is and with organizations.
And so there's a separate fake fake number 1129 that emphasizes the
point that the requirement is not about physical labeling on the QoS
is job here is to check out Media is classified and therefore make
sure the correct handling policies error applied to media containing
cardholder data.
The next sub requirement, 9.6 point two,
is the first of those media handling policies,
which demands that all media containing cardholder data is sent by secure
courier or any other way that allows the media to be tracked.
So using an external curious,
pretty obvious you pick one that offers tracking on by tracking the stand
doesn't doesn't mean there's a GPS receiver attached.
The median you could tell wherever it is in the world,
any time it means the normal sort of courier tracking where
it's logged by the career when it's picked up.
MOVED from Depot to Depot and then logged when it's delivered.
I've once seen this requirement cause a problem.
When cardholder data needed to be sent back from the retail stores to
head office and company used their own delivery trucks,
the ones that delivered goes to the store and they
were returning empty to head office.
And so the idea was, Well,
they can pick up the packages containing cardholder
data and take it back to head office.
And rather than just throwing the packages in the back of the truck,
they got sort of tamperproof numbered envelopes and use their stock
returns tracking system for the store to say,
which envelope being sent on which truck there simply to acknowledge receipt
of each numbered envelopes head office when it arrived.
So that Zanon idea could use for that.
To test this requirement,
the QoS is going to talk to people to make sure there's a
tracking system in use on the QoS is going to look at a
sample of records error tracking logs,
the evidence that media is properly tracked.
The last of requirement is that all movements of media with
cardholder data are approved by management and here,
the QC A is going to check the logs for evidence that
management approvals been recorded that they'll also interview
people to make sure this process happens.
Personally,
I used to make sure that what happened also matched the
organization's written procedures,
especially where management as a sort of pre authorized a regular daily process.