Policy 19 — Physical & Media Security Policy

← All 21 policies

This page is the rule, not the implementation. It states what Revique must do, at or above the PCI DSS minimum. How Revique actually does it today — the real AWS configuration, the current values, and where an auditor logs in to verify them — is in Procedure 19. Values shown as [X] are placeholders still to be set.

Purpose

To protect physical access to systems and the security of media containing CHD/PHI, recognizing the cloud shared-responsibility model.

Scope

Applies to physical facilities (via cloud provider) and all electronic media containing CHD/PHI.

Policy statements

Each statement below is mandatory. The bolded must marks the obligation.

1Physical security of the underlying data centers must be assured through the cloud provider (evidence obtained at least annually).

2Electronic media containing CHD/PHI must be encrypted and access-controlled.

3Media must be securely disposed of when no longer required.

4An inventory of media containing CHD/PHI must be maintained where applicable.

Roles & responsibilities

Role	Responsibility
Security Officer	Obtain provider attestations and manage media controls.
DevOps / IT	Enforce media encryption and disposal.

Enforcement

This policy is issued under the authority of Policy 01 — Information Security Policy and is mandatory for everyone in scope. Compliance is verified through the controls and evidence described in the linked procedure. Failure to comply may result in withdrawal of access and disciplinary action. This policy is reviewed at least annually, or sooner on significant change.

⚙️See the Procedure for this policyHow Revique implements this rule today, the current values, the gaps, and the auditor verification path→