Media
PCIComplianceHubLast updated
Any physical material that can hold data: disks and other electronic storage, removable media such as USB drives and optical discs, backup tapes, and paper reports and receipts. Requirement 9 governs media with cardholder data from the moment it exists to the moment it is destroyed.
Applies to. Every entity that holds cardholder data on anything physical, which includes the paper reports an SAQ A merchant is allowed to keep.
Example. A box of signed receipts in a stock room, a backup tape in a courier's van and a decommissioned server's disk are all media with cardholder data. Each must be physically secured (9.4.1), classified by sensitivity (9.4.2), sent only by a trackable method with management approval (9.4.3, 9.4.4), inventoried at least annually if it is electronic (9.4.5), and destroyed so the data cannot be recovered when no longer needed (9.4.6, 9.4.7).
Limits. Media is the part of scope that cloud-hosted entities most often forget, because their servers are somewhere else and their filing cabinet is not. Backups stored off site are media (9.4.1.1). Removable electronic media has its own narrower definition and an extra control (5.3.3). Paper with a full PAN is stored PAN: it must be kept only as long as the retention policy under 3.2.1 allows.