To verify compliance with media inventory requirements, what should auditors review?

To verify compliance with media inventory requirements, what should auditors review?

• A. Reviewing media inventory logs to verify that logs are maintained and inventories are performed at least annually.
• B. Reviewing only last quarter's inventory entries.
• C. Checking only electronic media logs.
• D. Verifying that media inventories are performed monthly.

Answer: (D)

The key idea is that media inventories must be checked with frequent, ongoing verification to ensure every item that could hold cardholder data is known, tracked, and safeguarded. Auditors look for evidence that the organization maintains up-to-date media inventory records and verifies the physical and/or electronic media on a regular schedule. Reviewing monthly media inventories provides timely visibility, helps detect lost, stolen, or misplaced items quickly, and demonstrates ongoing control rather than a once-a-year snapshot. Choosing monthly inventories over the other options matters because an annual check can allow discrepancies to go unnoticed for long periods, and reviewing only the last quarter or only electronic logs misses either earlier gaps or non-electronic media. Monthly reviews give continuous assurance that all media is accounted for and properly managed.

The key idea is that media inventories must be checked with frequent, ongoing verification to ensure every item that could hold cardholder data is known, tracked, and safeguarded. Auditors look for evidence that the organization maintains up-to-date media inventory records and verifies the physical and/or electronic media on a regular schedule. Reviewing monthly media inventories provides timely visibility, helps detect lost, stolen, or misplaced items quickly, and demonstrates ongoing control rather than a once-a-year snapshot.

Choosing monthly inventories over the other options matters because an annual check can allow discrepancies to go unnoticed for long periods, and reviewing only the last quarter or only electronic logs misses either earlier gaps or non-electronic media. Monthly reviews give continuous assurance that all media is accounted for and properly managed.