Are media back-ups stored in a secure location, 9.5.1 Observe physical security at media preferably in an off-site facility, such as an alternate location or backup site, or a commercial storage facility? Is this location’s security reviewed at least annually? Review policies and procedures for reviewing offsite media locations Interview security personnel Is strict control maintained over the internal or 9.6 Review policies and procedures for external distribution of any kind of media? distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be Review policies and procedures for determined? classification Interview security personnel 9.6.2 Is sent by secured courier or other delivery method Interview personnel that can be accurately tracked? Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained to moving the Interview personnel media (especially when media is distributed to Examine media distribution individuals)? tracking logs and documentation 9.7 Is strict control maintained over the storage and Review policies and procedures accessibility of media? Are inventory logs of all media properly maintained? 9.7.1 Examine inventory logs Are periodic media inventories conducted at least Examine inventory logs annually? Interview personnel Is all media destroyed when it is no longer needed for 9.8 Review periodic destruction business or legal reasons? policies and procedures
9.5.1 Are media back-ups stored in a secure location, preferably in an off-site facility, such as an alternate or backup site, or a commercial storage facility? Observe physical security at media location Is this location’s security reviewed at least annually? Review policies and procedures for reviewing offsite media locations Interview security personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be determined? Review policies and procedures for classification Interview security personnel 9.6.2 Is sent by secured courier or other delivery method that can be accurately tracked? Interview personnel Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained to moving the media (especially when media is distributed to individuals)? Interview personnel Examine media distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility of media? Review policies and procedures 9.7.1 Are inventory logs of all media properly maintained? Examine inventory logs Are periodic media inventories conducted at least annually? Examine inventory logs Interview personnel 9.8 Is all media destroyed when it is no longer needed for business or legal reasons? Review periodic destruction policies and procedures
PCI_DSS_v3-1_SAQ_D_Merchant_rev1-1.docx