PCI DSS 4.0 9.4.4: 9.4.4 Management approval for media leaving facility
Management must approve every movement of media with cardholder data outside the facility, including media handed out to individuals. The guidance explains that without firm approval before media leaves secure areas, it may not be tracked or protected and its whereabouts may be lost. Applicability: the approver should hold sufficient management authority to grant the approval, but their job title does not have to include the word manager. Objective under the customized approach: media stays inside a facility unless accountable personnel approve its removal.
This control maps to 36 controls across 14 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events
NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
NIST-CSF-PR.PS-05 Installation and execution of unauthorized software are prevented
You are reading one control. How much of PCI DSS 4.0 have you already done?
PCI DSS 4.0 9.4.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.