9.5.1 Store media backups in a secure location, preferably an off-site facility, such as an alternate or backup site, or a commercial storage facility. Review the location’s security at least annually.
9.5.1 Verify that the storage location security is reviewed at least annually to confirm that backup media storage is secure.
If stored in a non-secured facility, backups that contain cardholder data may easily be lost, stolen, or copied for malicious intent.
Periodically reviewing the storage facility enables the organization to address identified security issues in a timely manner, minimizing the potential risk.