Which statement describes a media destruction policy under 9.8?

• A. It covers all media and defines destruction requirements for both hard-copy and electronic media
• B. It covers only hard-copy media
• C. It covers only electronic media
• D. Destruction policy is optional

Answer: (A)

A media destruction policy must apply to all media types containing cardholder data and specify how to render data unrecoverable. That means the policy should cover both hard-copy materials (like printouts and reports) and electronic media (such as laptops, servers, USB drives, and backups), with clear destruction methods appropriate to each type. PCI DSS requires a comprehensive policy because CHD can reside in multiple formats, and leaving any one format out creates a security gap during disposal. The policy isn’t optional; having a defined, formal process ensures consistent, approved destruction practices across all media.