9.4.4 Management approval for media moved outside the facility
Management approves all movement of media holding cardholder data outside the facility, including when media is distributed to individuals, so media cannot leave a facility without the approval of accountable personnel.
5
artefacts
2
held by a system
1
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Offsite media tracking logs showing an approver against each movement · SIEM / log platform
- Approval records or tickets for a sample of media movements, including media distributed to individuals · Ticketing / ITSM
periodic reviewEvidence produced at each review
- Interview notes with personnel responsible for despatching media · Data governance / DLP tooling
governing documentDocuments that govern the control
- Documented procedure requiring management approval before media leaves the facility · Policy repository / GRC workspace
- Definition of who holds the authority to approve media movements · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Courier collections logged after the fact with no prior approval
- Approval implied by the shipping record rather than captured as a decision
- Media handed directly to individuals treated as outside the process
- Approver authority undefined, so anyone in the team signs the log
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet9.4.3 Media sent outside facility secured · 9.4.5 Inventory logs of electronic media