9.4 Media with cardholder data: requirements and evidence

What PCI DSS 9.4 asks for and why media handling fails assessments

If you are the compliance lead for a payment environment, your cardholder data rarely sits in one room. It sits on backup tapes at a storage vendor, in exported reports on a finance laptop, on USB drives used by a store team, and in printed receipts in a back office. Requirement 9.4 asks you to know where every one of those copies is, control how it moves, and destroy it properly when it is no longer needed. The ten sub-requirements, 9.4.1 to 9.4.7 with 9.4.1.1, 9.4.1.2 and 9.4.5.1, read best as one chain: secure the media physically, classify it so people know what they are holding, track any movement with management approval, keep an inventory, and destroy it with a method that leaves nothing recoverable. A gap at any link breaks the chain for the rest.

The risk is concrete. A lost backup tape, an unencrypted drive in a courier bag, or a box of paper reports in a recycling bin can expose account data without any attacker touching a network. Assessors therefore test the records as much as the media. The two items that most often fail are the electronic media inventory, which must be performed at least once every 12 months under 9.4.5.1, and the review of offline backup locations, which must also happen at least once every 12 months under 9.4.1.2. If your team cannot produce a dated inventory that matches what is actually in storage, or a review showing that the off-site backup location was checked against its security requirements, the assessor has little to accept.

Before the next assessment, ask three questions of your team: which systems and vendors create media with cardholder data, who approves each movement of that media, and when the last inventory and offline backup location review were signed off. Paper is in scope too, as the SSC's guidance on paper containing cardholder data confirms, so receipts and reports belong in the same register. Confirm the exact wording of each sub-requirement and its testing procedure in the current SAQ or ROC template with your assessor, since those documents set what evidence is expected.

Which media, locations and third parties fall under 9.4

Requirement 9.4 applies to every medium that holds cardholder data, whether it is paper, a disk, a tape or a copy sitting at a vendor. The cards below cover the scoping decisions that determine how many media items and locations your team must control, track and review.

Paper receipts and reports

PCI SSC FAQ 1069 confirms that PCI DSS applies to paper containing cardholder data, such as receipts and reports. Printed daily settlement reports, chargeback files and customer service printouts all count. Check where staff print, file and discard paper in the cardholder data environment and in back offices, because paper often escapes the electronic inventory.

Electronic media and removable drives

USB drives, external disks, laptops, and optical discs used to copy or move cardholder data are all electronic media under 9.4. Inventory them with asset tags and record who holds each device. Removable drives are the most common source of untracked copies, so confirm that staff cannot copy data to personal or unmanaged media.

Offline backup sets

Tapes, cartridges and disk sets written offline for recovery are media with cardholder data, even when no one reads them day to day. Confirm which backup jobs write cardholder data, where each set is stored, and who can retrieve it. Backup tools such as Bareos keep a catalog of what each job holds, which helps you locate every offline set when an inventory is due.

Off-site storage locations

Off-site vaults, records storage companies and a second office holding backup media each form a separate location that the offline backup requirement covers. Ask every site where media is kept, who has keys or access codes, and when the location was last reviewed. Record each location in the inventory so the annual review has a complete list to check.

Vendors that collect or destroy media

Shredding companies, media destruction vendors and courier services take custody of cardholder data outside your premises. Their handling falls within the scope of the transport and destruction controls, so your contracts and chain-of-custody records must show how media is tracked and destroyed. Ask each vendor for certificates of destruction and a description of its secure transport and storage.

Smaller cardholder data environment

Each system that stores cardholder data adds media to your scope, so limiting where card data lands reduces the number of items you must inventory and destroy. Tokenization, point-to-point encryption and outsourced payment processing can all keep card data away from internal systems. Map every data flow before counting media, because a shrinking environment is the most direct way to shrink the 9.4 workload.

How to build the media controls in the right order

This sequence moves from knowing what media exists to proving it is stored, moved and destroyed under control. Each step produces a record that the next step depends on, so an assessor can trace one piece of cardholder data from creation to destruction.

Find and classify every medium holding cardholder data
Start by locating every place cardholder data lives outside the live payment systems: backup tapes and disks, removable drives, laptops, printed reports, receipts, scanned images and archived mailboxes. Paper counts too, since PCI DSS applies to paper containing cardholder data. Assign each item a classification that reflects its sensitivity so that handling rules can follow the label. The output is a first-pass media register with an owner, location and classification for each item, reviewed by the data owner and the compliance lead.
Define storage and offline backup rules
Write the storage standard for each media class, covering where it may be kept, who may access it, and how it is protected in the facility. For offline backups, document the secure off-site or separate locations and the controls that protect them. Requirement 9.4.1.2 expects the security of those backup locations to be reviewed at least once every 12 months, so record the review owner and the review checklist now. The output is a media storage standard and a backup location register that the review will later check against.
Set secured transport and management approval rules
Define how media leaves a secure area, including the carrier, packaging, tracking method and recipient checks. Require management approval before any media is moved, and specify who may approve and how the approval is recorded. Keep the rule simple enough that staff follow it under pressure. The output is a transport procedure with an approval form or ticket template, plus a log design that captures sender, recipient, time and tracking reference for each movement.
Build the electronic and paper inventories
Using the register from the first step, create the formal inventory of electronic media with cardholder data, recording the asset identifier, media type, location, custodian and classification. Include paper holdings in a separate inventory so each has its own owner. Requirement 9.4.5.1 requires the electronic media inventory to be performed at least once every 12 months, so the inventory format should support repeat counts. Asset management tools such as GLPI can hold the register, and endpoint inventory from Wazuh Syscollector can help confirm which systems hold data. The output is a dated inventory that a second person has reconciled against physical or system evidence.
Schedule the 12-month inventory and backup location reviews
Put the electronic media inventory and the offline backup location review on a recurring calendar owned by a named person, with the evidence each one must produce. Record the date of the last completed review and the next due date for each item. Confirm with your assessor how they expect dates and sign-offs to be shown. The output is a recurring task record with completed reviews attached, which an assessor can match to the 12-month requirement.
Set destruction methods for paper and electronic media
Define approved destruction for each media type. Requirement 9.4.6 expects hard-copy materials to be cross-cut shredded, incinerated or pulped. Requirement 9.4.7 expects electronic media to be destroyed or the data rendered unrecoverable, so document the method for each device or medium type and any third-party vendor used. Require a destruction record that ties each item to the method, date and person responsible. The output is a destruction procedure and a destruction log, ideally backed by a certificate from any external destruction vendor, which you should confirm meets your assessor's expectations.
Confirm the chain of evidence before the assessment
Walk one item through the whole sequence: its register entry, storage rule, transport approval, inventory line, recurring review and destruction record. Any gap found here will also appear to an assessor, so fix it while the trail is still short. Ask your QSA or assessor which samples they will pull and how they want the evidence packaged. The output is a tested evidence pack and a short list of open gaps with owners, which the compliance lead signs off before the assessment begins.

How an assessor tests 9.4 and which evidence they request

This table maps each part of Requirement 9.4 to the test approach an assessor typically follows, the evidence they ask for, and the gaps they most often find. Read each row as a checklist for your own evidence folder before the assessment starts, and treat the findings column as the places where teams usually lose time.

Test area	Test approach and evidence requested	Common findings
Physical security of media (9.4.1)	Assessor walks the storage locations and asks who can enter them. They request the media storage policy, access lists for storage rooms or cabinets, and sample access logs.	Media stored in shared offices or unlocked cabinets with no record of who holds keys or badges.
Offline backup location reviews (9.4.1.2)	Assessor checks that the security of each offline backup location was reviewed within the last 12 months. They request the review record, its date, the reviewer and any corrective actions.	Offline backup sites are listed in the plan but have no dated review, or the review does not cover physical access controls.
Classification of media (9.4.2)	Assessor samples media and asks how it is labeled by sensitivity. They request the classification scheme and labeling examples tied to cardholder data.	Backup tapes, drives or exports are unlabeled, so staff cannot tell which media holds cardholder data.
Secured transport and management approval (9.4.3 and 9.4.4)	Assessor follows one movement of media from its origin to its destination. They request courier or transport records, chain-of-custody forms and the management approval recorded for each move.	Approvals are given verbally or by email without a record, and tracking stops at the courier handover.
Electronic media inventory (9.4.5 and 9.4.5.1)	Assessor compares the inventory against the media they find on site. They request the inventory, its logs and proof that a review took place at least once every 12 months.	Inventory exists but is out of date, does not list removable drives or backup copies, and has no annual check.
Hard-copy destruction (9.4.6)	Assessor watches or reviews a destruction event. They request the destruction policy, shredder or pulping records, and vendor certificates if a third party performed the work.	Receipts or reports are placed in general waste or in bins without a locked container, or the destruction method is not the one the requirement allows.
Electronic media destruction or unrecoverable data (9.4.7)	Assessor asks how drives and tapes leave service. They request the sanitization or destruction procedure, the disposal log and evidence the data cannot be recovered.	Drives are reissued or sold without a documented wipe, or the log does not link each device to its destruction record.

Which evidence passes 9.4 and how to keep it current

Requirement 9.4 is tested through records, not through intentions. The six artifacts below are the ones an assessor typically asks to see, and each one only holds up if it is updated as work happens rather than rebuilt before the assessment.

Electronic media inventory

The inventory lists every electronic medium holding cardholder data, with its type, location, owner and the data it contains. Requirement 9.4.5.1 requires this inventory to be checked at least once every 12 months, but a list that only changes at that point will not match the systems. Tie additions and removals to the change process and to asset records, such as those held in an asset register, so the inventory is corrected when media is created, moved or retired.

Backup location review records

Requirement 9.4.1.2 requires the security of offline backup locations to be reviewed at least once every 12 months. Keep a dated, signed record of each review that covers physical access, environmental controls and who holds keys or combinations. Between reviews, log access changes to those sites so the reviewer starts from a known state rather than from memory.

Classification records

Classification shows which media hold cardholder data and how sensitive that data is, which determines the controls applied to it. Record the classification at the point media is created or first received, and revisit it when a data flow changes. Where paper or files are reclassified, the reason and date belong in the record so an assessor can trace why a medium is protected at a given level.

Transport logs and approvals

Requirement 9.4.3 covers secured transport and 9.4.4 covers management approval before media is moved outside the secured area. Each movement should have a log entry with the medium identifier, sender, recipient, carrier, dates and the approver's name. Set a rule that a movement without an approval record is not started, so the log stays complete instead of being reconstructed later.

Destruction certificates and vendor reports

Requirement 9.4.6 requires hard-copy materials to be cross-cut shredded, incinerated or pulped, and 9.4.7 requires electronic media to be destroyed or rendered unrecoverable. Keep a destruction record for each batch that names the items, method, date and operator. When a vendor performs destruction, retain the certificate or report and confirm it describes the method used. Ask the vendor which standard their process follows and confirm that wording in the contract.

Storage access records

Access records show who entered the storage areas holding media and when. Requirement 9.4 depends on the physical controls in 9.2 and 9.3, so these logs are the proof that those controls operated. Review entries on a schedule, investigate any access that does not match an approved task, and retain the reviews. Confirm your retention period for these records with your assessor before the review cycle starts.

What meeting 9.4 costs in money and effort

This table lists the cost components behind Requirement 9.4, who is paid for each, whether it is one-time or recurring, and what drives it up or down. No prices are published here because none were supplied, so use the questions in the final column to build a comparable quote. The main takeaway is that most recurring cost comes from staff time and evidence upkeep, not from licenses.

Cost component	One-time or recurring	Who is paid and what drives cost
Secure storage and locks for media	One-time setup, recurring upkeep	Internal facilities or a vendor for cabinets, safes and access hardware. Driven by media volume and number of storage sites. Ask for itemized hardware and installation.
Offline backup site reviews (9.4.1.2)	Recurring, at least every 12 months	Internal security staff or an implementation partner for the annual review. Driven by the number of offline backup locations. Ask who performs the review and what the written output includes.
Inventory tooling and licenses (9.4.5.1)	Recurring if commercial, one-time if self-hosted setup	Commercial asset or backup software vendors charge licenses. Self-hosted open-source options such as GLPI and Bareos remove license spend but still need hosting and administration. Ask whether licensing is per device, per site or per user.
Transport and tracking of media	Recurring per movement	Internal logistics or a courier. Driven by how often media leave the facility and whether secured couriers are needed. Ask for chain-of-custody record formats and approval workflow effort.
Destruction services or equipment (9.4.6, 9.4.7)	Recurring per batch or one-time for equipment	A certified destruction vendor or internal cross-cut shredders, incinerators or degaussing tools. Driven by paper and media volume. Ask for certificates of destruction and whether the vendor's process is documented for your assessor.
Staff time for classification and approvals	Recurring	Internal data owners, security and operations staff. Driven by the number of media types, approval volume and training frequency. This is often the largest recurring cost.
Evidence upkeep	Recurring	Internal compliance staff or a partner who keeps inventories, logs, approval records and destruction records current and retrievable for assessment.
Assessor sampling and testing	Recurring at each assessment	The independent QSA or assessor charges for testing. Driven by the number of sites, media flows and samples requested. Ask the assessor how sampling will be scoped before agreeing to a fee.

Which self-hosted open-source tools support 9.4 evidence

Requirement 9.4 is mostly a process requirement, so no tool satisfies it alone. The four tools below can produce records an assessor may ask for: backup catalogs, integrity checks, asset inventories and endpoint inventories. Each one leaves physical handling, transport approval and destruction to your own procedures and records.

Bareos backup catalog evidence

Bareos schedules backup, restore, verify and archive jobs and keeps a SQL catalog of backed-up files. That catalog can show which offline backups exist, when they were written and that restores were tested, which supports the offline backup and location review work in 9.4.1.1 and 9.4.1.2. The catalog does not show where a physical tape or disk sits. Confirm that your offline copies are tracked outside the Bareos server and that the review of their storage location is recorded separately. Check the Bareos license terms (AGPL-3.0-only) with your legal team before distributing modified versions.

restic integrity check evidence

The restic check command verifies the structural consistency of snapshots, trees and pack files. Running it with --read-data or --read-data-subset reads pack files back to confirm the stored backup data is unmodified. Those check outputs can document that offline backup repositories remain usable and unaltered between reviews. restic does not record where a repository is kept or who moved it, so pair its logs with your physical custody records. Its BSD-2-Clause license permits broad reuse with few conditions, but confirm how your team packages and redistributes it.

GLPI asset inventory evidence

GLPI Assets records computers, monitors, network equipment, peripherals, printers, phones and racks, either entered manually or pushed by the GLPI Agent. An inventory of this kind supports the requirement to keep inventories of hardware that stores cardholder data. It does not track removable media such as tapes, USB drives or paper records, so you will need a separate media register for those. Confirm that the GLPI Agent covers the systems in scope. GLPI is licensed under GPL-3.0-or-later, so review obligations before you modify and distribute it.

Wazuh Syscollector endpoint inventory

The Wazuh Syscollector module collects hardware, operating system, installed software, network interfaces, services and users from each endpoint and stores them in the Wazuh indexer. Dashboard reports can show which endpoints hold software and data at a given time, which helps with the electronic media inventory and its annual refresh. Syscollector does not see external drives that are not connected, nor does it confirm destruction of storage. Verify coverage against your asset list before relying on it. Wazuh is licensed under GPL-2.0-only, so confirm the terms that apply to your deployment model.

Doing 9.4 in-house or with a partner, and where the auditor draws the line

Your organization owns Requirement 9.4 in full. Accountability for media with cardholder data, including paper receipts and reports, electronic media and offline backups, stays with you even when a vendor performs the physical work. Your team decides how media is classified, who may approve moving it offsite, which storage locations are used, and when destruction is required. These decisions must be written down and followed in daily operations, because the assessor samples actual records rather than policy text.

Classification and approval rules: Define the classes of media, the approvers for each movement, and the way approvals are recorded.
Offline backup locations: Confirm each location, its access controls and the yearly security review under 9.4.1.2.
Inventory ownership: Keep the inventory of electronic media with cardholder data current and complete the 12-month review under 9.4.5.1.
Destruction records: Approve destruction methods and retain certificates or logs that show hard copy and electronic media were destroyed.
Evidence custody: Store logs, approvals and review sign-offs where the assessor can sample them.

Before engaging anyone, check that your team can produce a dated example of each control for the assessment period.

Where organizations usually fall short on media controls

Requirement 9.4 fails less often on the rules themselves than on the records behind them. The gaps below share one root cause: organizations know media exists but cannot show where every copy is, who approved its movement, or how it was destroyed. Each gap has a closing action an assessor can verify.

Media that exists only at a vendor

Backups sent to a third-party service, cloud archive or off-site storage provider often leave no entry in the internal media inventory. The organization's records then show nothing for copies it still depends on. Check whether every backup target, including vendor-hosted and tape-rotation services, appears in the inventory with its location and custodian. Confirm in the vendor contract who controls physical and logical access to those copies and where they are stored.

Offline backup sites never reviewed

Offline backup locations are often set up once and then forgotten. Requirement 9.4.1.2 expects the security of those locations to be reviewed at least once every 12 months, and a review that never happened is a clear finding. Schedule the review as a recurring task, cover access lists, environmental controls and the physical lock and seal state, and keep the signed record with the date and reviewer.

Inventories that stop at servers

Many media inventories list production servers and skip paper reports, printed receipts, laptops, USB drives and tape cartridges. Requirement 9.4.5.1 covers electronic media with cardholder data, and PCI SSC guidance confirms that paper containing cardholder data is in scope. Start from data-flow diagrams and export jobs, then trace each output to where it lands. Discovery tools such as GLPI or Wazuh can seed the asset list, but staff must still add the media they do not manage.

Transport without approval records

Media is often moved between offices, data centers or couriers on an informal basis, with no written authorization and no tracking. Requirement 9.4.3 expects media sent outside the secured area to be logged and approved by management, using secure transport that can be tracked. Create a simple transfer form with item identifiers, origin, destination, courier, and an approver's signature. Test a sample of recent moves against the log to confirm that nothing left the building unrecorded.

Destruction without proof

Shredding and wiping often happen, but the organization cannot show what was destroyed or how. Requirement 9.4.6 covers hard copy, which must be cross-cut shredded, incinerated or pulped, and 9.4.7 covers electronic media, which must be destroyed or rendered unrecoverable. Keep a destruction log with item identifiers, method, date and a certificate of destruction from any external shredding or disposal provider. Ask the provider to state its method and chain of custody in writing before work begins.

Backups that cannot be restored

Offline copies that are never tested can fail silently, leaving the organization with media it cannot use. Requirement 9.4.1 requires offline backups to be kept secure, but a backup is only evidence of recoverability when it is read back. Tools such as restic can check pack files with a read-data option, and Bareos can run verify jobs against catalog entries. Record each test, the scope sampled and the result, and retain those records for the assessor.

Questions buyers ask about 9.4 cost, effort and outside help

How much extra work does requirement 9.4 add beyond existing backup practice?

For most teams, the extra work is in the paperwork and the physical controls around backups, not in the backups themselves. Requirement 9.4 asks for media with cardholder data to be physically secured, classified, tracked when moved, and destroyed properly, and it adds two annual reviews: an inventory of electronic media (9.4.5.1) and a review of the security of offline backup locations (9.4.1.2). A backup job that already runs well still needs a documented offline storage location, a list of what it holds, an approval trail for moving it, and a destruction record when it reaches end of life. Expect the largest gap in the inventory and the transport log, since these are rarely kept today. Confirm with your assessor exactly which media in your environment fall under the requirement, including paper receipts and reports, which the PCI SSC treats as in scope.

Can a small team meet requirement 9.4 without outside help?

A small team can meet 9.4 alone if it has a clear owner, a current list of media, and time for the annual reviews. The harder part is consistency: someone must track every tape, drive, printout and courier movement, and prove it. Outside help is most useful when the team lacks a documented inventory, has backups held by third parties, or has never run a formal destruction process. A consultant can set up the procedures and records, but the organization still runs them. Ask whether the environment is small enough that a single owner can keep the records current without becoming a bottleneck.

What does requirement 9.4 need from the organization day to day?

The organization must own the controls and run them continuously. In practice that means four things: a named role for media handling, a written procedure for classifying media and approving any move of it, a physical storage area with access restricted to authorized staff, and records kept current. Each movement needs management approval and a transport log, and each destruction needs evidence that the media were cross-cut shredded, incinerated or pulped (paper, 9.4.6) or destroyed or rendered unrecoverable (electronic, 9.4.7). Staff who handle media need to know these steps, because most findings come from informal handling, not missing policies.

How long does preparation take against the 12-month review cycle?

Preparation depends on how many media locations and movements you have, and no duration is supplied for this work. Plan for two parts. The first is a one-time build: the inventory, the classification scheme, the transport and destruction procedures, and the first review of offline backup locations. The second is the recurring cycle: the inventory and the offline storage review must each happen at least once every 12 months, so the first full cycle needs to be scheduled from the start. Ask any provider to state its plan in writing, with the milestones and the evidence each milestone produces, before work begins.

What drives the cost of meeting requirement 9.4?

Cost is driven by volume, distribution and age of the media, not by the requirement text. The main drivers are the number of storage sites and offline backup locations, how many electronic and paper items fall in scope, whether backups are held by a third party, how much of the transport is done by staff versus couriers, and whether destruction is done in house or by a certified vendor. One-time costs include building the inventory, procedures and storage controls. Recurring costs include the annual reviews, ongoing logging, and destruction services. No cost figure is supplied for this topic, so ask each provider to price these components separately in a written scope.

Can our QSA or assessor help us build the 9.4 controls?

No. A QSA or other assessor must stay independent of the controls it tests, so it cannot design, build or operate them and then certify them. The assessor's role is to examine your evidence and issue the Report on Compliance or Attestation of Compliance. Your organization owns the controls, and an implementation partner can prepare systems, procedures and records in advance. Keep those roles separate in the contract so the assessor's work is not compromised.

Which evidence should we request in a quote for 9.4 work?

Ask for a written scope that lists each deliverable and the evidence it produces. For 9.4, request the media inventory template and a sample completed inventory, the offline backup location review record, the classification procedure, the transport log and approval workflow, the destruction certificates or logs for paper and electronic media, and the training records for staff who handle media. Also ask which tools will hold the records. For example, GLPI's Assets module can hold equipment records, and Wazuh's Syscollector can collect system inventory from endpoints, though neither is a substitute for a media-specific inventory unless configured for it. Confirm these capabilities with the vendor before relying on them.

How DeployOpen works on this

DeployOpen works on 9.4 Media with cardholder data by preparing the systems and records that show how media is stored, moved, inventoried and destroyed. Work runs inside your own cloud accounts, data centers or air-gapped networks, and your organization keeps ownership of its controls. An independent QSA issues the ROC or AOC; DeployOpen does not.

How we scope

The written scope names each media type, storage location and offline backup site covered by 9.4.
It lists the sub-requirements in and out of scope, including paper receipts and reports under PCI SSC FAQ 1069.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we build

Configuring the offline backup platform, for example Bareos or restic, with restore tests and documented job records.
Verification runs such as restic check with read-data, confirming stored backups are unmodified.
Electronic media inventory held in an asset register, such as GLPI Assets, checked against 9.4.5.1 each cycle.

How we hand over

A written evidence pack per sub-requirement: procedures, configurations, inventories, destruction logs and offline backup location review records.
Runbooks for media transport approval, shredding and wiping, owned by named client roles.
A list of open items for the QSA, with the client confirming which evidence the assessor will sample.

How we support

Periodic re-review of the offline backup site and inventory cycle, available under a retainer to meet the 12-month requirement.
Support for the QSA's questions on media records, delivered as a retainer after the fixed-scope work.
Confirm with your team whether an outside destruction vendor provides destruction logs you can retain.