9.5.1 Store media backups in a secure location, preferably an off-site facility, such as an alternate or backup site, or a commercial storage facility. Review the location’s security at least annually.
9.5.1.a Observe the storage location’s physical security to confirm that backup media storage is secure.
9.5.1.b Verify that the storage location security is reviewed at least annually.
If stored in a non-secured facility, backups that contain cardholder data may easily be lost, stolen, or copied for malicious intent.