Which of the following is NOT considered media containing cardholder data?

The option stating "Physical destruction orders" is correct because it does not contain cardholder data (CHD) itself. Physical destruction orders refer to documents or directives related to the disposal or destruction of data-bearing media that has contained CHD, rather than media containing that data. Such orders serve as a procedural aspect in ensuring compliance with data security measures but do not inherently hold or store cardholder data.

In contrast, encrypted paper records, electronic flash drives with CHD, and computer hard drives containing transaction logs all include forms of media that do hold or can potentially harbor cardholder data. Encrypted paper records may store cardholder information but are secure due to encryption, while electronic flash drives and hard drives actively store data that is directly associated with transactions involving cardholders. Thus, options referring to actual data-bearing media are classified as containing cardholder data, highlighting the distinction between the destruction processes or orders and the actual media themselves.