[Autogenerated] so far.
Then we've covered storing,
moving an inventorying media containing cardholder data.
The last set of physical media related requirements were about the
disposal and destruction of media on the requirements really simple
that when the media is no longer required,
it needs to be secured destroyed on the reserve
requirements that you need to follow,
depending on whether it's paper or magnetic media is being
destroyed for this main requirement.
The testing procedures for the USA to check the media destruction
policy and procedures on to make sure they align with the demands
that are put in the sub requirements,
which for paper is that paper is going to be disposed to got to be shredded,
burned or pulp on with an additional requirement.
That paper waiting to be destroyed is stood in a locked
container like a confidential waste bin.
But the people can't take the paper out off while it's waiting to be destroyed.
On.
To test this,
the QoS A is going to look at any waste containers to make sure they're locked.
They'll speak with people, responsible,
the destruction of paper and also check the policies and procedures.
The QoS A doesn't have to physically observe or
validate the method of destruction.
But if you've got destruction logs or evidence of destruction,
that's that's used, that's quite useful.
If you say use an external company that comes and takes away
paper to be destroyed will usually give you a certificate
that shows that they've done it.
When it comes to electronic media, the standard is less prescriptive.
Just saying that data can't be reconstructed from the destroyed media.
Remember, this is about ensuring that the data isn't recoverable,
so secure wiping,
dig a housing and then physical destruction error all suggested in
the guidance and a valid ways of doing it again.
I've seen Qs is have come from a national security or military background,
get over excited by this requirement and insist on unlike military great
shredding of disk platters and wouldn't allow a secure wipe using an
industrial like a standard industry application.
So it's useful to remind them of a what the standard says and be that
our threat actor isn't the secret service of another nation state here
but a criminal after cardholder data.
The testing procedure is more hands on is the QoS.
Azure has actually got to verify the data rendered is unrecoverable,
so they could watch the secure wipe operation or they
could look at destroyed drives.
Now, honestly,
the chance of you doing this while the QoS is on site
for the annual assessments rare.
So I suggest that you keep a media physical media
destruction blog for the QoS A.
To see,
which has got the evidence that there's one person who destroyed the
media and how they did it on a second independent person.
Validated it being done properly because the QoS occurred.
Then check those logs and interview the people concerned.
Now we're almost at the end of requirement nine.
We've just got to cover the security of physical card reading devices.
But before we do that, let's join the conversation I had with Jacob,
where we discuss how some QoS is could get fixated on
Requirement nine on what to do about it