PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/151 of 250
9.4.1.1Media with cardholder data is securely stored, accessed, distributed, and destroyed
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
Offline media backups with cardholder data are stored in a secure location.
Defined Approach Testing Procedures:
9.4.1.1.a Examine documentation to verify that procedures are defined for physically securing offline media backups with cardholder data in a
secure location.PurposeIf stored in a non-secured facility, backups containing cardholder data may easily be lost, stolen, or copied for malicious intent.Good PracticeFor secure storage of backup media, a good practice is to store media in an off-site facility, such as an alternate or backup site or commercial storage facility.
9.4.1.1.b Examine logs or other documentation and interview responsible personnel at the storage location to verify that offline media backups are stored in a secure location.