9.4.6 Hard copy media destruction
Hard copy materials with cardholder data are destroyed when no longer needed for business or legal reasons via crosscut shredding, incineration, or pulping.
5
artefacts
2
held by a system
1
at each review
moderate
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Certificate of Destruction from shredding vendor · Vendor register / contract repository
- Secure bin locations and pickup logs · SIEM / log platform
periodic reviewEvidence produced at each review
- Witness sign-off for on-site destruction · Data governance / DLP tooling
governing documentDocuments that govern the control
- Destruction policy specifying methods · Policy repository / GRC workspace
- Photos of destroyed material · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Vendor register / contract repository); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Standard recycling used
- No certificates
- Bins unlocked
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet9.4.5.1 Inventories of electronic media with cardholder data are conducted at least once every 12 months · 9.4.7 Electronic media destruction