How should CHD on removable media be protected?

How should CHD on removable media be protected?

• A. Removable media CHD is unencrypted for speed
• B. CHD on removable media is encrypted wherever stored
• C. Removable media encryption is optional
• D. Only hot backups are encrypted

Answer: (B)

Protect CHD on removable media by encrypting it wherever it’s stored. Removable media is easy to lose or steal, so if the data is encrypted, it remains unreadable to anyone who doesn’t have the cryptographic key, reducing the risk of exposure. PCI DSS requires rendering cardholder data unreadable anywhere stored using strong cryptography, which includes CHD on portable media and any backups. That means CHD on removable media should be encrypted in all storage scenarios, not only in some cases. Unencrypted storage is insecure because physical loss or theft could expose sensitive data. Encryption being optional is not acceptable, and encrypting only hot backups leaves CHD on the primary removable media unprotected.

Protect CHD on removable media by encrypting it wherever it’s stored. Removable media is easy to lose or steal, so if the data is encrypted, it remains unreadable to anyone who doesn’t have the cryptographic key, reducing the risk of exposure. PCI DSS requires rendering cardholder data unreadable anywhere stored using strong cryptography, which includes CHD on portable media and any backups. That means CHD on removable media should be encrypted in all storage scenarios, not only in some cases.

Unencrypted storage is insecure because physical loss or theft could expose sensitive data. Encryption being optional is not acceptable, and encrypting only hot backups leaves CHD on the primary removable media unprotected.