Which statement best describes the organization’s policy on distributing media?

Which statement best describes the organization’s policy on distributing media?

• A. There is no policy governing media distribution.
• B. The policy exists to control distribution of media, but only for media stored on-site.
• C. The policy exists to control distribution of media, but does not cover distribution to individuals.
• D. The policy exists to control distribution of media, and covers all distributed media including distribution to individuals.

Answer: (D)

In PCI DSS, media handling isn't just about how data is stored; it also covers how it is moved or shared. A robust media distribution policy must apply to any media containing cardholder data, no matter where it goes or who receives it. That means safeguards are in place for distributing to partners, contractors, or even individuals, not just to internal locations. This makes the best answer because it states that the policy exists to control distribution of media and that it covers all distributed media, including when media is sent to individuals. It ensures consistent protection—such as encryption, labeling, access controls, and tracking—across every possible recipient and pathway. The other options fall short because they limit the policy's scope: some imply no policy exists, others restrict coverage to on-site media, and others exclude distributions to individuals. In practice, any transfer of media with sensitive data should be governed by the policy to prevent exposure or misuse.

In PCI DSS, media handling isn't just about how data is stored; it also covers how it is moved or shared. A robust media distribution policy must apply to any media containing cardholder data, no matter where it goes or who receives it. That means safeguards are in place for distributing to partners, contractors, or even individuals, not just to internal locations.

This makes the best answer because it states that the policy exists to control distribution of media and that it covers all distributed media, including when media is sent to individuals. It ensures consistent protection—such as encryption, labeling, access controls, and tracking—across every possible recipient and pathway.

The other options fall short because they limit the policy's scope: some imply no policy exists, others restrict coverage to on-site media, and others exclude distributions to individuals. In practice, any transfer of media with sensitive data should be governed by the policy to prevent exposure or misuse.