Backup media storage should be secured off-site, and the location's security should be reviewed how often?

• A. Annually
• B. Biannually
• C. Quarterly
• D. Monthly

Answer: (A)

Periodic verification of the off-site backup storage security is the key idea here. For backups stored away from your primary environment, you need to confirm that the facility protecting those media continues to have proper physical and access controls, environmental protections, and security procedures. Doing this review at least once a year strikes the right balance: it keeps security posture current as personnel and processes change, without adding excessive, ongoing overhead.

Annual reviews also fit well with other governance and compliance rhythms, and they serve as a timely check after any changes to the off-site arrangement, such as a new storage provider or updated transport methods. More frequent reviews aren’t typically required by PCI DSS and can be unnecessarily burdensome, while less frequent reviews increase the risk that security gaps go unnoticed for too long.