9.4.3Media with cardholder data is securely stored, accessed, distributed, and destroyed

Defined Approach Requirements:

Media with cardholder data sent outside the facility is secured as follows:

• Media sent outside the facility is logged.

• Media is sent by secured courier or other delivery method that can be accurately tracked.

• Offsite tracking logs include details about media location

Defined Approach Testing Procedures:

9.4.3.a Examine documentation to verify that procedures are defined for securing media sent outside the facility in accordance with all elements specified in this requirement.

9.4.3.b Interview personnel and examine records to verify that all media sent outside the facility is logged and sent via secured courier or other delivery method that can be tracked.

9.4.3.c Examine offsite tracking logs for all media to verify tracking details are documented.