Is there some specific tracking requirements for a SRED certified device?
I'm using a SRED-certified device. Do I need to keep a list of all SNs of the SRED devices they handle, destroy, etc?
Answer:
There are no “SRED” rules to follow, the deployment and management of SRED devices/serial numbers/etc are probably related to P2PE compliance (SRED is a hardware certification).
Users should reach out to their P2PE auditor on what needs to be provided per a P2PE audit. We know one thing is that we need to provide serial numbers of units that we’ve shipped. However, the maintenance of the devices in the user's possession needs to be managed by the user, not the supplier.