Which approach is required for distributing media?

Which approach is required for distributing media?

• A. Internal distribution should be untracked to improve efficiency.
• B. External distribution should be conducted without security considerations.
• C. Maintain strict control over the internal or external distribution of any kind of media.
• D. Distribution is only needed for digital media.

Answer: (C)

Controlling the distribution of media containing sensitive data is essential. PCI DSS requires maintaining strict control over how media is moved, whether it stays inside the organization or goes outside it. This means you should have formal procedures for handling, labeling, tracking, and securing media such as printed reports, backups on tapes or drives, USB devices, and other storage means. The goal is to prevent cardholder data from being exposed if media is lost, stolen, or intercepted during transit, and to ensure there’s an auditable record of who handles the media and when. Why this is the best approach: it explicitly covers both internal and external distribution, acknowledging that risk exists no matter where the media travels. By maintaining strict control, you enforce access restrictions, use secure transport or encryption for external transfers, and implement proper disposal when media is no longer needed. This aligns with PCI DSS guidance to protect media across its entire lifecycle. Untracked internal distribution would open the door to unauthorized access within the organization. External distribution without security measures is directly risky and violates the need for secure handling. Limiting distribution only to digital media ignores physical forms that can contain cardholder data, which also require protections.

Controlling the distribution of media containing sensitive data is essential. PCI DSS requires maintaining strict control over how media is moved, whether it stays inside the organization or goes outside it. This means you should have formal procedures for handling, labeling, tracking, and securing media such as printed reports, backups on tapes or drives, USB devices, and other storage means. The goal is to prevent cardholder data from being exposed if media is lost, stolen, or intercepted during transit, and to ensure there’s an auditable record of who handles the media and when.

Why this is the best approach: it explicitly covers both internal and external distribution, acknowledging that risk exists no matter where the media travels. By maintaining strict control, you enforce access restrictions, use secure transport or encryption for external transfers, and implement proper disposal when media is no longer needed. This aligns with PCI DSS guidance to protect media across its entire lifecycle.

Untracked internal distribution would open the door to unauthorized access within the organization. External distribution without security measures is directly risky and violates the need for secure handling. Limiting distribution only to digital media ignores physical forms that can contain cardholder data, which also require protections.