Which method is an approved way to render cardholder data on electronic media unrecoverable?

• A. Secure wipe program in accordance with industry-accepted standards
• B. Encrypting the data on the electronic media
• C. Backing up the media for archiving
• D. Overwriting the media with random data without following standards

Answer: (A)

Rendering cardholder data unrecoverable on electronic media is about sanitizing the media so data cannot be recovered by normal means. A secure wipe program that follows industry-accepted standards does exactly that by overwriting the stored data in a controlled, verifiable way, making it unrecoverable. This aligns with established sanitization practices (clear/purge/destroy) recognized by PCI DSS and other standards, ensuring the wipe is effective and verifiable.

Encrypting the data alone doesn’t erase it; the data can still exist on the media and become recoverable if the encryption keys are obtained. Backing up the media is about preservation, not sanitization. Overwriting with random data without following standards may not guarantee complete erasure or verifiability, so it’s not considered an approved method.