9.4.5 Inventory logs of all electronic media with cardholder data are maintained.
Defined Approach Requirements
9.4.5 Inventory logs of all electronic media with cardholder data are maintained.
Defined Approach Testing Procedures
9.4.5.a Examine documentation to verify that procedures are defined to maintain electronic media inventory logs.
9.4.5.b Examine electronic media inventory logs and interview responsible personnel to verify that logs are maintained.
Customized Approach Objective
Accurate inventories of stored electronic media are maintained.
Purpose
Without careful inventory methods and storage controls, stolen or missing electronic media could go unnoticed for an indefinite amount of time.
Sub-requirements
purpose
Conduct periodic media inventories to verify accuracy.
compliance strategies
- Scheduled audits
- Reconciliation with inventory records
typical policies
- Media Audit Procedures
common pitfalls
- Missed audits
- No reconciliation process
type
Process Control
difficulty
Moderate
key risks
- Undetected media loss
recommendations
- Automate audit reminders
Eligible SAQ
- SAQ-D MERCHANT
- SAQ-D SERVICE PROVIDER
Your perspective on this PCI DSS requirement matters! Share your implementation experiences, challenges, or questions below. Your insights help other organizations improve their compliance journey and build a stronger security community.Comment Policy