Removable Electronic Media
PCIComplianceHubLast updated
Media built to be taken out of one system and carried to another: USB flash drives, external hard drives, optical discs, memory cards. The Council excludes hot-swappable drives and bulk backup tapes, which are media but not the portable kind, so this term is about what fits in a pocket.
Applies to. Every entity, because the risk is that a drive with cardholder data leaves the building in one, or brings malware in.
Example. A support engineer copies a database export to a USB drive to move it between systems. The drive now holds stored PAN and is media under 9.4; 5.3.3 requires it to be scanned for malware when it is connected, or the anti-malware to run continuously, and 3.5.1.2 notes that full-disk encryption is an acceptable method for rendering PAN unreadable on removable media, unlike on fixed disks.
Limits. The exclusion of hot-swappable and backup drives matters because those are governed as fixed media and backups (9.4.1.1) instead. Removable media is where the distinction between disk-level encryption and other methods in 3.5.1.2 cuts the other way: on a portable drive, disk encryption is the point.