PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/152 of 250
9.4.1.2Media with cardholder data is securely stored, accessed, distributed, and destroyed
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
The security of the offline media backup location(s) with cardholder data is reviewed at least once every 12 months.
Defined Approach Testing Procedures:
9.4.1.2.a Examine documentation to verify that procedures are defined for reviewing the security of the offline media backup location(s) with cardholder data at least once every 12 months.
9.4.1.2.b Examine documented procedures, logs, or other documentation, and interview responsible personnel at the storage location(s) to verify that the storage location’s security is reviewed at least once every 12 months.