As Component of PCI data security specifications, physical cardholder information should even be stored in a protected spot, like a locked area or storage spot with limited entry. Formally attest your compliance. An AOC (attestation of compliance) is the form you utilize to sign which you’ve obtained PCI DSS compliance. https://www.nathanlabsadvisory.com/blog/tag/regulatory-requirements/