[Autogenerated] a Z.
We come to the security of media incident security facilities.
There are four requirements that deal with medium on.
Remember, this is for both paper and electronic media,
which is cardholder data on it, starting with Requirement 9.5,
which is to physically secure all media.
The requirement is quite vague and just demands that
you physically secure or media.
So this is the way you need to have policies and procedures which will,
ideally be backed up by your annual risk.
Assessment on the QoS is just going to check these policies and procedures.
There's one sub requirement which specifically deals,
says we're back up media and traditionally this means tapes
which needs to be kept securely and again.
The standards doesn't specify what controls error
needed to make the storage secure,
but it does require it of review annually the security of the facilities
where the backup media is stored especially interesting to nodes that this is
the only requirement in the whole of PC IDE CSS.
That actually makes a passing reference to availability
because if you look at PC IDE CSS,
the standards main aim is to guard against the breach of
confidentiality of cardholder data.
However, here, hidden in requirement 9.5 point one,
there is the suggestion that backup maybe should be still
preferably in an off site location,
so that the fact that the CSS has suggested off site means that it z
thinking about availability rather than confidentiality.
Importantly, here, the testing procedure is not for the QoS a.
To review the security of the storage of backup major,
but rather for them to check that you've done the review and you've
kept your evidence of why you think it is secure.