Which requirement specifies maintaining strict control over the storage and accessibility of media?

Which requirement specifies maintaining strict control over the storage and accessibility of media?

• A. Maintain strict control over the storage and accessibility of media.
• B. Media inventories must be performed quarterly.
• C. All media must be encrypted at rest.
• D. Access to media is not restricted.

Answer: (A)

The main idea here is controlling who can access media and where it is kept. In PCI DSS, you must protect any media that contains cardholder data by enforcing strict access controls and secure storage, as part of the media lifecycle management. This means only authorized individuals should be able to handle or reach stored media, and it should be kept in secure locations when not in use. That direct focus on limiting access and securing storage is why this option is the best fit. Other choices relate to related practices but don’t pin down this specific control: keeping an inventory helps with asset management, and encryption at rest protects data if media is accessed, but neither alone establishes the mandatory restriction on access to stored media. Stating that access is not restricted contradicts the security requirement.

The main idea here is controlling who can access media and where it is kept. In PCI DSS, you must protect any media that contains cardholder data by enforcing strict access controls and secure storage, as part of the media lifecycle management. This means only authorized individuals should be able to handle or reach stored media, and it should be kept in secure locations when not in use. That direct focus on limiting access and securing storage is why this option is the best fit.

Other choices relate to related practices but don’t pin down this specific control: keeping an inventory helps with asset management, and encryption at rest protects data if media is accessed, but neither alone establishes the mandatory restriction on access to stored media. Stating that access is not restricted contradicts the security requirement.