Framework № PCI DSS 4.0 от 01.03.2022

9.4.1
Defined Approach Requirements: 
All media with cardholder data is physically secured. 

Customized Approach Objective:
Media with cardholder data cannot be accessed by unauthorized personnel. 

Defined Approach Testing Procedures:

Purpose:
Controls for physically securing media are intended to prevent unauthorized persons from gaining access to cardholder data on any media. Cardholder data is susceptible to unauthorized viewing, copying, or scanning if it is unprotected while it is on removable or portable media, printed out, or left on someone’s desk. 

9.4.1.1
Defined Approach Requirements: 
Offline media backups with cardholder data are stored in a secure location. 

Customized Approach Objective:
Offline backups cannot be accessed by unauthorized personnel. 

Defined Approach Testing Procedures:

Purpose:
If stored in a non-secured facility, backups containing cardholder data may easily be lost, stolen, or copied for malicious intent. 

Good Practice:
For secure storage of backup media, a good practice is to store media in an off-site facility, such as an alternate or backup site or commercial storage facility. 

9.4.1.2
Defined Approach Requirements: 
The security of the offline media backup location(s) with cardholder data is reviewed at least once every 12 months. 

Customized Approach Objective:
The security controls protecting offline backups are verified periodically by inspection. 

Defined Approach Testing Procedures:

Purpose:
Conducting regular reviews of the storage facility enables the organization to address identified security issues promptly, minimizing the potential risk. It is important for the entity to be aware of the security of the area where media is being stored. 

9.4.2
Defined Approach Requirements: 
All media with cardholder data is classified in accordance with the sensitivity of the data 

Customized Approach Objective:
Media are classified and protected appropriately. 

Defined Approach Testing Procedures:

Purpose:
Media not identified as confidential may not be adequately protected or may be lost or stolen. 

Good Practice:
It is important that media be identified such that its classification status is apparent. This does not mean however that the media needs to have a “confidential” label. 

9.4.3
Defined Approach Requirements: 
 Media with cardholder data sent outside the facility is secured as follows:

Customized Approach Objective:
Media is secured and tracked when transported outside the facility. 

Defined Approach Testing Procedures:

Purpose:
Media may be lost or stolen if sent via a nontrackable method such as regular postal mail. The use of secure couriers to deliver any media that contains cardholder data allows organizations to use their tracking systems to maintain inventory and location of shipments. 

9.4.4
Defined Approach Requirements: 
Management approves all media with cardholder data that is moved outside the facility (including when media is distributed to individuals). 

Customized Approach Objective:
Media cannot leave a facility without the approval of accountable personnel. 

Applicability Notes:
Individuals approving media movements should have the appropriate level of management authority to grant this approval. However, it is not specifically required that such individuals have “manager” as part of their title. 

Defined Approach Testing Procedures:

Purpose:
Without a firm process for ensuring that all media movements are approved before the media is removed from secure areas, the media would not be tracked or appropriately protected, and its location would be unknown, leading to lost or stolen media. 

9.4.5
Defined Approach Requirements: 
Inventory logs of all electronic media with cardholder data are maintained. 

Customized Approach Objective:
Accurate inventories of stored electronic media are maintained. 

Defined Approach Testing Procedures:

Purpose:
Without careful inventory methods and storage controls, stolen or missing electronic media could go unnoticed for an indefinite amount of time. 

9.4.5.1
Defined Approach Requirements: 
Inventories of electronic media with cardholder data are conducted at least once every 12 months. 

Customized Approach Objective:
Media inventories are verified periodically. 

Defined Approach Testing Procedures:

Purpose:
Without careful inventory methods and storage controls, stolen or missing electronic media could go unnoticed for an indefinite amount of time. 

9.4.6
Defined Approach Requirements: 
Hard-copy materials with cardholder data are destroyed when no longer needed for business or legal reasons, as follows:

Customized Approach Objective:
Cardholder data cannot be recovered from media that has been destroyed or which is pending destruction. 

Applicability Notes:
These requirements for media destruction when that media is no longer needed for business or legal reasons are separate and distinct from PCI DSS Requirement 3.2.1, which is for securely deleting cardholder data when no longer needed per the entity’s cardholder data retention policies. 

Defined Approach Testing Procedures:

Purpose:
If steps are not taken to destroy information contained on hard-copy media before disposal, malicious individuals may retrieve information from the disposed media, leading to a data compromise. For example, malicious individuals may use a technique known as “dumpster diving,” where they search through trashcans and recycle bins looking for hard-copy materials with information they can use to launch an attack. 
Securing storage containers used for materials that are going to be destroyed prevents sensitive information from being captured while the materials are being collected. 

Good Practice:
Consider “to-be-shredded” containers with a lock that prevents access to its contents or that physically prevent access to the inside of the container. 

Further Information:
See NIST Special Publication 800-88, Revision 1: Guidelines for Media Sanitization. 

9.4.7
Defined Approach Requirements: 
Electronic media with cardholder data is destroyed when no longer needed for business or legal reasons via one of the following:

Customized Approach Objective:
Cardholder data cannot be recovered from media that has been erased or destroyed. 

Applicability Notes:
These requirements for media destruction when that media is no longer needed for business or legal reasons are separate and distinct from PCI DSS Requirement 3.2.1, which is for 
securely deleting cardholder data when no longer needed per the entity’s cardholder data retention policies. 

Defined Approach Testing Procedures:

Purpose:
If steps are not taken to destroy information contained on electronic media when no longer needed, malicious individuals may retrieve information from the disposed media, leading to a data compromise. For example, malicious individuals may use a technique known as “dumpster diving,” where they search through trashcans and recycle bins looking for information they can use to launch an attack. 

Good Practice:
The deletion function in most operating systems allows deleted data to be recovered, so instead, a dedicated secure deletion function or application should be used to make data unrecoverable. 

Examples:
Methods for securely destroying electronic media include secure wiping in accordance with industry-accepted standards for secure deletion, degaussing, or physical destruction (such as grinding or shredding hard disks). 

Further Information:
See NIST Special Publication 800-88, Revision 1: Guidelines for Media Sanitization