[Autogenerated] it's easy to get requirement 9.7 Confused.
A requirement.
9.6 Because they both talk about media logs and inventories,
9.6 was about media moving around on outside the organization.
Requirement 9.7 is about how it's stored within the organization,
and it wants an inventory of all media containing
cardholder data to be maintained.
Now you remember back in requirement 9.5.
The requirement 9.5 wanted all media to be physically secured.
Requirement 9.7 then is about access to that stored media
and checking that it hasn't gone missing.
The wording of the requirement is that you have to maintain strict
control over the storage and accessibility of media.
And that doesn't align with the testing procedure,
which actually just says the QoS a has got to obtaining.
Examine the policy for controlling the storage,
um, maintenance of media and verify that the policy contains media inventories.
So the QoS is going to be looking for a policy that says
how security of stories controlled On.
More importantly, the policy says,
there's got to be an annual infantry of the media in storage
because the core of requirement 9.7 is this sub requirement
that a log is maintained on that the log is reconciled to the
inventory on an annual basis.
So the idea is that the log should say what's in the storage area
and once a year that you check the log that says What should be in
the storage area on what it is on?
That's what the queue so will check.
They're going to check those immediate blog that is maintained.
They're going to look for evidence of an annual
reconciliation of what the log says should be in the media
store on what's actually stored on.
Although this test requirement doesn't say so,
most QoS is well,
actually want to interview the person who conducted the annual inventory review.