9.4.4Media with cardholder data is securely stored, accessed, distributed, and destroyed

Defined Approach Requirements:

Management approves all media with cardholder data that is moved outside the facility (including when media is distributed to individuals).

Defined Approach Testing Procedures:

9.4.4.a Examine documentation to verify that procedures are defined to ensure that media moved outside the facility is approved by management.

9.4.4.b Examine offsite media tracking logs and interview responsible personnel to verify that proper management authorization is obtained for all media moved outside the facility (including media distributed to individuals).