9.4 Media with cardholder data is securely stored, accessed, distributed and destroyed
How to meet it
Classify, secure, track and securely destroy media holding card data.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 9.4, in plain English.
9.4.1All media containing cardholder data is physically secured.
9.4.1.1Offline media backups holding cardholder data are kept in a secure location.
9.4.1.2The offline backup location security is reviewed at least every 12 months.
9.4.2All media with cardholder data is classified by sensitivity.
9.4.3Media sent outside the facility is logged, sent by trackable secure courier, and recorded in offsite tracking logs.
9.4.4Management approves all media with cardholder data moved outside the facility.
9.4.5Inventory logs of all electronic media with cardholder data are maintained.
9.4.5.1Media inventories are performed at least every 12 months.
9.4.6Hard-copy materials no longer needed are destroyed by cross-cut shredding, incineration, or pulping.
9.4.7Electronic media no longer needed is destroyed or the data rendered unrecoverable.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Physical and environmental security policyUse for ISO 27001 A.7.1 to A.7.14, SOC 2 Security, and PCI DSS requirement 9 physical access controls.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.
Open the control-to-policy map← 9.3 Physical access for personnel and visitors is authorised and managed9.5 Point-of-interaction (POI) devices are protected →
Back to Requirement 9, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.