The PCI-DSS SAQ A is used in the case where all payments are outsourced to an external vendor (conditions apply).

Despite that, section 9 of the questionnaire is about "media" (if they are physically secured, if their move follows policies, etc.).

What specific media are they talking about? All payment operations are outsourced so why asking about "media"? (I am asking not about the nature of the media (it has to be paper per requirements) but the possible content)


Any entity should also protect paper documents that contain cardholder data in accordance with PCI DSS requirements 9.6 through 9.10. For example, requirement 9.6 states "Physically secure all paper and electronic media (including computers, electronic media, networking and communications hardware, telecommunication lines, paper receipts, paper reports, and faxes) that contain cardholder data."

What is cardholder data?

Cardholder data (CD) is any personally identifiable information (PII) associated with a person who has a credit or debit card

So what is PII?

Personally identifiable information (PII) is any data that could potentially identify a specific individual. Any information that can be used to distinguish one person from another and can be used for de-anonymizing anonymous data can be considered PII.

Consider receiving receipts with client information on it like addresses, names or other PII. That's the content they are targetting.

  • Thank you - very concise answer. We will not receive paper data but only electronic information - which must not (per the requirements) contain any "cardholder data". – WoJ Oct 21 '15 at 7:44
  • Just out of curiosity, what's the reference for those quotes? Doesn't seem like SSC phrasing. – gowenfawr Oct 21 '15 at 11:43
  • @gowenfawr techtarget searchfinancialsecurity.techtarget.com/definition/… – Lucas Kauffman Oct 21 '15 at 12:06
  • @LucasKauffman Didn't see this answer before I posted mine below. Stupid non-updating browser. Ah well. But one point I might make: despite the definition of the term "media" in the SAQ-A question, elsewhere the scope rules for the SAQ-A that specifically limit merchants who can use the SAQ-A to merchants who, at the most, have paper documentation containing cardholder data. – mostlyinformed Oct 21 '15 at 17:05
  • @halfinformed: I can get electronic information form my processor provided they do not contain "cardholder data". Otherwise e-commerce would not work (you would not get any feedback form the processor, no ability to get the country of the card for tax purposes etc.). From the doc: "Merchant retains only paper reports or receipts with cardholder data, and these documents are not received electronically." (emph. mine) – WoJ Oct 21 '15 at 17:09

The short answer to your question: In SAQ-A "media" refers exclusively to paper documentation that contains cardholder data. Know you mentioned in your question that you were interested in the content of the sensitive information that a merchant may store and not the physical nature of the media containing it, but in this case you must look at both elements together in thinking about what "media" really refers to under SAC-A.

The slightly longer answer:

Let's begin with what the text of the very first question in SAQ-A (on page 4 of the doc). In assessing compliance with PCI Requirement 9.5 card information storage protections, the document asks:

Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)?

For purposes of Requirement 9, “media” refers to all paper and electronic media containing cardholder data.

Now to any sensible person, that quick definition means, well, pretty much exactly what it says: "media" is used in a very broad sense of the term. Meaning any physical item (or at least any physical item separate or separable from a computer, probably) that stores or contains payment card information, whether the info exists on paper, in electronic form on a disc or drive, or in some other kind of medium. So, the text of the definition we get in the actual questions of the SAQ casts a very wide net.

But here's the thing: for practical purposes in dealing with SAQ-A, the real, practical definition of "media" for a merchant is actually much narrower.

The confusion comes from a very understandable source: despite the above definition of "media" referenced in the actual question/ss about Requirement 9.5, the scope rules that determine what kinds of merchants qualify to use the SAQ-A directly say that a SAQ-A merchant ordinarily shouldn't have payment card info stored on any "media". The single possible category of exceptions? You said it: paper documentation. Or in the exact words of "Part 2g -- Eligibility to Complete SAQ A" checklist in the SAQ-A document (page 3):

Merchant retains only paper reports or receipts with cardholder data, and these documents are not received electronically.

Bottom line: Yes, as used in SAQ-A "media" refers only to "paper reports or receipts". Despite the confusing, much broader definition also referenced* in the same SAQ. (And, FYI, merchants who do happen to have non-paper media with payment card data floating around in their operations need to take another hard look at the rules about who qualifies to file under SAQ-A.)

I know, it's enough to drive one mad. The wonderful world of PCI. :)

Edit: The full SAQ-A scope checklist:

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.