Which statement best describes requirement 9.7.1 regarding media inventories?

Which statement best describes requirement 9.7.1 regarding media inventories?

• A. Inventory logs of all media must be maintained.
• B. Inventory logs of all media must be maintained and media inventories conducted at least annually.
• C. Inventories must be conducted monthly.
• D. Inventories are optional.

Answer: (B)

This requirement focuses on knowing where every piece of media that could hold cardholder data is, and making sure you verify it regularly. Keeping an inventory log creates a current list of all media—backup tapes, USB drives, external hard drives, laptops, and other devices that might store CHD—and records who owns each item and where it’s stored. Conducting media inventories at least annually adds a verification step: you physically check that the log matches what exists, helping to catch missing, misplaced, or decommissioned media and ensuring proper handling or disposal. The best option combines both elements: maintain the inventory log and perform annual inventories. The other statements don’t meet the requirement because merely keeping logs doesn’t include a formal verification step, monthly inventories aren’t the stated minimum, and saying inventories are optional contradicts the need for accountability and verification.

This requirement focuses on knowing where every piece of media that could hold cardholder data is, and making sure you verify it regularly. Keeping an inventory log creates a current list of all media—backup tapes, USB drives, external hard drives, laptops, and other devices that might store CHD—and records who owns each item and where it’s stored. Conducting media inventories at least annually adds a verification step: you physically check that the log matches what exists, helping to catch missing, misplaced, or decommissioned media and ensuring proper handling or disposal.

The best option combines both elements: maintain the inventory log and perform annual inventories. The other statements don’t meet the requirement because merely keeping logs doesn’t include a formal verification step, monthly inventories aren’t the stated minimum, and saying inventories are optional contradicts the need for accountability and verification.