PCI DSS v4.0/Requirement 09: Restrict Physical Access to Cardholder Data/153 of 250
9.4.2Media with cardholder data is securely stored, accessed, distributed, and destroyed
Control family: Requirement 09: Restrict Physical Access to Cardholder Data
Control description
Defined Approach Requirements:
All media with cardholder data is classified in accordance with the sensitivity of the data.
Defined Approach Testing Procedures:
9.4.2.a Examine documentation to verify that procedures are defined for classifying media with cardholder data in accordance with the sensitivity of the data.
9.4.2.b Examine media logs or other documentation to verify that all media is classified in accordance with the sensitivity of the data
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.