Which action satisfies requirement 9.8.2 for electronic media?

Which action satisfies requirement 9.8.2 for electronic media?

• A. Render cardholder data on electronic media unrecoverable.
• B. Encrypt electronic media to protect data.
• C. Delete the file without overwriting.
• D. Archive electronic media indefinitely.

Answer: (A)

The action tested is sanitizing electronic media that stores cardholder data so that the data cannot be recovered. Requirement 9.8.2 specifies that when electronic media containing cardholder data is no longer needed or is being repurposed or disposed of, the data must be rendered unrecoverable. This means using methods like physical destruction (crushing, shredding), degaussing for magnetic media, or cryptographic erasure (destroying the encryption keys so the data cannot be decrypted). Relying on encryption alone isn’t enough for disposal, because if the media is discarded with the keys available or if the keys aren’t destroyed, the data could still be recovered. Deleting a file without overwriting leaves residual data that can often be recovered, and archiving indefinitely keeps the data accessible rather than making it unrecoverable. So the best-fit action is to render the data unrecoverable on the electronic media.

The action tested is sanitizing electronic media that stores cardholder data so that the data cannot be recovered. Requirement 9.8.2 specifies that when electronic media containing cardholder data is no longer needed or is being repurposed or disposed of, the data must be rendered unrecoverable. This means using methods like physical destruction (crushing, shredding), degaussing for magnetic media, or cryptographic erasure (destroying the encryption keys so the data cannot be decrypted). Relying on encryption alone isn’t enough for disposal, because if the media is discarded with the keys available or if the keys aren’t destroyed, the data could still be recovered. Deleting a file without overwriting leaves residual data that can often be recovered, and archiving indefinitely keeps the data accessible rather than making it unrecoverable. So the best-fit action is to render the data unrecoverable on the electronic media.