Identify the documented policies and procedures that:
i. Define the legal, regulatory, and business requirements for data retention
ii. Specifically address retention requirements for cardholder data
Identify the responsible personnel interviewed who confirm:
i. The legal, regulatory, and business requirements that retention requirements are based on
ii. That the documented policies and procedures for data retention are implemented