Which statement reflects requirement 9.8.1 regarding hard-copy materials?

Which statement reflects requirement 9.8.1 regarding hard-copy materials?

• A. Shred, incinerate, or pulp hard-copy materials so that cardholder data cannot be reconstructed.
• B. Store hard-copy materials in secure storage until disposal.
• C. Shred, incinerate, or pulp hard-copy materials so that cardholder data cannot be reconstructed; secure storage containers used for materials that are to be destroyed.
• D. Do not destroy hard-copy materials; they can be retained indefinitely.

Answer: (C)

The idea being tested here is how to properly handle hard-copy materials that contain cardholder data under PCI DSS. The rule emphasizes both securing hard-copy documents that you need to keep and destroying them when they’re no longer required, in a way that makes cardholder data unrecoverable. The best choice reflects that dual requirement: you must use secure storage containers to hold hard-copy materials that are going to be destroyed, and when you dispose of them, you must shred, incinerate, or pulp them so the data cannot be reconstructed. This captures both the precaution of secure containment and the effectiveness of destruction. The other options miss one piece of the picture. Destruction alone isn’t enough if there isn’t secure storage for materials awaiting disposal. Storing materials securely without prescribed destruction leaves you vulnerable to improper disposal or access. And stating that hard-copy materials can be retained indefinitely contradicts the need to dispose of data when it’s no longer required.

The idea being tested here is how to properly handle hard-copy materials that contain cardholder data under PCI DSS. The rule emphasizes both securing hard-copy documents that you need to keep and destroying them when they’re no longer required, in a way that makes cardholder data unrecoverable.

The best choice reflects that dual requirement: you must use secure storage containers to hold hard-copy materials that are going to be destroyed, and when you dispose of them, you must shred, incinerate, or pulp them so the data cannot be reconstructed. This captures both the precaution of secure containment and the effectiveness of destruction.

The other options miss one piece of the picture. Destruction alone isn’t enough if there isn’t secure storage for materials awaiting disposal. Storing materials securely without prescribed destruction leaves you vulnerable to improper disposal or access. And stating that hard-copy materials can be retained indefinitely contradicts the need to dispose of data when it’s no longer required.