What is the required destruction method for hard-copy materials containing CHD?

• A. Crosscut shredding, incineration, or pulping
• B. Burning in a non-controlled environment
• C. Degaussing the documents
• D. Using a regular home shredder without crosscutting

Answer: (A)

For hard-copy materials containing cardholder data, the data must be made unreadable and unusable through destruction. The approved methods—cross-cut shredding, incineration, or pulping—physically destroy the documents so they cannot be reconstructed. Cross-cut shredding cuts the paper into small, confetti-like pieces, which makes reconstruction impractical. Incineration reduces the material to ash, and pulping disrupts the fibers, both preventing recovery of the data.

Other options don’t meet the requirement. Burning in a non-controlled environment is unsafe and uncontrolled, so it’s not an acceptable method. Degaussing applies to magnetic storage, not paper, so it doesn’t affect CHD on hard copies. A regular home shredder that doesn’t cross-cut may leave readable strips or chunks and could be reconstructible, which isn’t adequate for PCI DSS destruction requirements.