Compliance · PCI DSS
PCI DSS Media Handling and Offsite Custody
PCI has explicit expectations about physical media: secure storage, controlled distribution, logged movement, and destruction when the data is no longer needed. That maps to custody more directly than most frameworks do.
Bring your retention schedule. We will tell you what it actually costs to meet it.
Read this first. This page is general background on how physical custody supports a compliance program. It isnot legal advice, it does not state retention periods, and it does not certify that any arrangement satisfies any rule. Requirements change and vary by firm. Get the answer from your own counsel or compliance officer, then tell us what you need us to do.
Scope
Who this applies to
Any business that stores, processes, or transmits cardholder data — and the service providers supporting them.
The recurring themes
- Physical security of media containing cardholder data.
- Control and logging of media distribution and movement.
- Approval before media leaves a secured area.
- Destruction of media when it is no longer needed for business or legal reasons.
Our part
What custody actually contributes
- Secured physical storage in a 9R vault with man-trap entry.
- Scanned, timestamped logs for every movement in and out.
- Named authorized parties, so distribution is controlled rather than ad hoc.
- Witnessed physical destruction with serialized certificates.
Get this right
The common misreading
The most common misreading is scope. Organizations assume the requirements apply to a payments system somewhere, when scope follows cardholder data wherever it actually lives — including old backup media, decommissioned hardware and paper nobody has looked at in years. The practical consequence is that a forgotten box can bring an environment into scope that everyone believed was out of it.
Evidence
What tends to be asked for
Assessors want to know where cardholder data exists, how it is protected there, and how media is handled and destroyed. For material in physical custody, the useful evidence is the intake log, controlled access, named authorized parties, and documented destruction with verification against a list. The scoping decision itself is not ours to make — if you are unsure whether stored media is in scope, that question belongs with your assessor before it belongs with a vault.
Said plainly
What we do not do
Storage is one requirement among many. We do not perform assessments, we are not a QSA, and using us does not make an environment compliant. We never access media contents.
Common questions
- Are you a QSA?
- No. We are a custodian. Your assessor evaluates your environment.
- Do you log every movement?
- Yes, scanned and timestamped, in and out.
- Is a software wipe acceptable?
- We do not offer one. We do physical destruction because it is verifiable and a wipe certificate is not.
Bring your retention schedule.
We will tell you plainly what custody covers and what it does not. That is a more useful conversation than a compliance claim.