Which statement best describes the scope of physical security measures for media?

• A. All media, including computers, removable electronic media, paper receipts, and faxes.
• B. Only paper documents stored in locked cabinets.
• C. Media protection applies only to digital data.
• D. No physical security measures are required for media.

Answer: (A)

Media protection must cover every form that could hold cardholder data, not just digital files. This means computers, removable electronic media, paper documents, receipts, and even faxes—all are in scope for physical security measures. The PCI DSS requires protecting these media at rest, during handling, and when stored or disposed of, wherever they exist in the environment. So the best description is that media protection applies to all media types, both electronic and paper, and across their entire lifecycle. Limiting to paper, or to digital data, or saying no measures are required would miss the full scope defined by the standard.