SAMMY works best on screens 1024px wide or larger.
12.1: An overall information security policy is: (a) Established, (b) Published, (c) Maintained, (d) Disseminated to all relevant personnel, as well as to relevant vendors and business partners.
  • Examine the information security policy and interview personnel to verify that the overall information security policy is managed in accordance with all elements specified in this requirement.
Description

Requirement 12.1.1

Purpose

An overarching information security policy provides the foundation for the entity's security program. It communicates management's commitment to protecting cardholder data and sets the framework for all security activities.

Good Practice

The information security policy should address all PCI DSS requirements and should be disseminated to all relevant personnel. The policy should be endorsed by executive management and should be reviewed at least annually.

Requirement 12.1.2

Purpose

The threat landscape and business environment are constantly evolving. Regular review and update of the information security policy ensures that it remains relevant and effective in addressing current risks and business requirements.

Good Practice

The information security policy should be reviewed at least annually and updated as needed to address changes in business objectives, risks, and regulatory requirements. Reviews should involve relevant stakeholders and should be documented.

Requirement 12.1.3

Purpose

The security policy should clearly define the security responsibilities of all personnel. Without clear definition, individuals may not understand their role in protecting cardholder data and may not take appropriate action.

Good Practice

The security policy should address the information security responsibilities of all personnel, including employees, contractors, and third-party users. It should define acceptable use of technology and specify consequences for policy violations.

Requirement 12.1.4

Purpose

The Chief Information Security Officer (CISO) or equivalent role provides executive-level accountability for the information security program. Without clear executive accountability, the security program may lack the authority and resources needed to be effective.

Good Practice

The CISO or equivalent should have direct responsibility for the entity's information security program. This role should have appropriate authority, access to senior management, and sufficient resources to effectively manage the security program.

12.1: The information security policy is: (a) Reviewed at least once every 12 months, (b) Updated as needed to reflect changes to business objectives or risks to the environment.
  • Examine the information security policy and interview responsible personnel to verify the policy is managed in accordance with all elements specified in this requirement.
Description

Requirement 12.1.1

Purpose

An overarching information security policy provides the foundation for the entity's security program. It communicates management's commitment to protecting cardholder data and sets the framework for all security activities.

Good Practice

The information security policy should address all PCI DSS requirements and should be disseminated to all relevant personnel. The policy should be endorsed by executive management and should be reviewed at least annually.

Requirement 12.1.2

Purpose

The threat landscape and business environment are constantly evolving. Regular review and update of the information security policy ensures that it remains relevant and effective in addressing current risks and business requirements.

Good Practice

The information security policy should be reviewed at least annually and updated as needed to address changes in business objectives, risks, and regulatory requirements. Reviews should involve relevant stakeholders and should be documented.

Requirement 12.1.3

Purpose

The security policy should clearly define the security responsibilities of all personnel. Without clear definition, individuals may not understand their role in protecting cardholder data and may not take appropriate action.

Good Practice

The security policy should address the information security responsibilities of all personnel, including employees, contractors, and third-party users. It should define acceptable use of technology and specify consequences for policy violations.

Requirement 12.1.4

Purpose

The Chief Information Security Officer (CISO) or equivalent role provides executive-level accountability for the information security program. Without clear executive accountability, the security program may lack the authority and resources needed to be effective.

Good Practice

The CISO or equivalent should have direct responsibility for the entity's information security program. This role should have appropriate authority, access to senior management, and sufficient resources to effectively manage the security program.

12.1: The security policy clearly defines information security roles and responsibilities for all personnel, and all personnel are aware of and acknowledge their information security responsibilities.
  • Examine the information security policy to verify that they clearly define information security roles and responsibilities for all personnel.
  • Interview personnel in various roles to verify they understand their information security responsibilities.
  • Examine documented evidence to verify personnel acknowledge their information security responsibilities.
Description

Requirement 12.1.1

Purpose

An overarching information security policy provides the foundation for the entity's security program. It communicates management's commitment to protecting cardholder data and sets the framework for all security activities.

Good Practice

The information security policy should address all PCI DSS requirements and should be disseminated to all relevant personnel. The policy should be endorsed by executive management and should be reviewed at least annually.

Requirement 12.1.2

Purpose

The threat landscape and business environment are constantly evolving. Regular review and update of the information security policy ensures that it remains relevant and effective in addressing current risks and business requirements.

Good Practice

The information security policy should be reviewed at least annually and updated as needed to address changes in business objectives, risks, and regulatory requirements. Reviews should involve relevant stakeholders and should be documented.

Requirement 12.1.3

Purpose

The security policy should clearly define the security responsibilities of all personnel. Without clear definition, individuals may not understand their role in protecting cardholder data and may not take appropriate action.

Good Practice

The security policy should address the information security responsibilities of all personnel, including employees, contractors, and third-party users. It should define acceptable use of technology and specify consequences for policy violations.

Requirement 12.1.4

Purpose

The Chief Information Security Officer (CISO) or equivalent role provides executive-level accountability for the information security program. Without clear executive accountability, the security program may lack the authority and resources needed to be effective.

Good Practice

The CISO or equivalent should have direct responsibility for the entity's information security program. This role should have appropriate authority, access to senior management, and sufficient resources to effectively manage the security program.

12.1: Responsibility for information security is formally assigned to a Chief Information Security Officer or other information security knowledgeable member of executive management. .
  • Examine the information security policy to verify that information security is formally assigned to a Chief Information Security Officer or other information security-knowledgeable member of executive management.
Description

Requirement 12.1.1

Purpose

An overarching information security policy provides the foundation for the entity's security program. It communicates management's commitment to protecting cardholder data and sets the framework for all security activities.

Good Practice

The information security policy should address all PCI DSS requirements and should be disseminated to all relevant personnel. The policy should be endorsed by executive management and should be reviewed at least annually.

Requirement 12.1.2

Purpose

The threat landscape and business environment are constantly evolving. Regular review and update of the information security policy ensures that it remains relevant and effective in addressing current risks and business requirements.

Good Practice

The information security policy should be reviewed at least annually and updated as needed to address changes in business objectives, risks, and regulatory requirements. Reviews should involve relevant stakeholders and should be documented.

Requirement 12.1.3

Purpose

The security policy should clearly define the security responsibilities of all personnel. Without clear definition, individuals may not understand their role in protecting cardholder data and may not take appropriate action.

Good Practice

The security policy should address the information security responsibilities of all personnel, including employees, contractors, and third-party users. It should define acceptable use of technology and specify consequences for policy violations.

Requirement 12.1.4

Purpose

The Chief Information Security Officer (CISO) or equivalent role provides executive-level accountability for the information security program. Without clear executive accountability, the security program may lack the authority and resources needed to be effective.

Good Practice

The CISO or equivalent should have direct responsibility for the entity's information security program. This role should have appropriate authority, access to senior management, and sufficient resources to effectively manage the security program.

12.1: An incident response plan exists and is ready to be activated in the event of a suspected or confirmed security incident. The plan includes, but is not limited to: (a) Roles, responsibilities, and communication and contact strategies in the event of a suspected or confirmed security incident, including notification of payment brands and acquirers, at a minimum, (b) Incident response procedures with specific containment and mitigation activities for different types of incidents, (c) Business recovery and continuity procedures, (d) Data backup processes, (e) Analysis of legal requirements for reporting compromises, (f) Coverage and responses of all critical system components, (g) Reference or inclusion of incident response procedures from the payment brands.
  • Examine the incident response plan to verify that the plan exists and includes at least the elements specified in this requirement.
  • Interview personnel and examine documentation from previously reported incidents or alerts to verify that the documented incident response plan and procedures were followed.
Description

Requirement 12.1.1

Purpose

An overarching information security policy provides the foundation for the entity's security program. It communicates management's commitment to protecting cardholder data and sets the framework for all security activities.

Good Practice

The information security policy should address all PCI DSS requirements and should be disseminated to all relevant personnel. The policy should be endorsed by executive management and should be reviewed at least annually.

Requirement 12.1.2

Purpose

The threat landscape and business environment are constantly evolving. Regular review and update of the information security policy ensures that it remains relevant and effective in addressing current risks and business requirements.

Good Practice

The information security policy should be reviewed at least annually and updated as needed to address changes in business objectives, risks, and regulatory requirements. Reviews should involve relevant stakeholders and should be documented.

Requirement 12.1.3

Purpose

The security policy should clearly define the security responsibilities of all personnel. Without clear definition, individuals may not understand their role in protecting cardholder data and may not take appropriate action.

Good Practice

The security policy should address the information security responsibilities of all personnel, including employees, contractors, and third-party users. It should define acceptable use of technology and specify consequences for policy violations.

Requirement 12.1.4

Purpose

The Chief Information Security Officer (CISO) or equivalent role provides executive-level accountability for the information security program. Without clear executive accountability, the security program may lack the authority and resources needed to be effective.

Good Practice

The CISO or equivalent should have direct responsibility for the entity's information security program. This role should have appropriate authority, access to senior management, and sufficient resources to effectively manage the security program.

12.1: At least once every 12 months, the security incident response plan is: (a) Reviewed and the content is updated as needed, (b) Tested, including all elements listed in Requirement 12.10.1.
  • Interview personnel and review documentation to verify that, at least once every 12 months, the security incident response plan is: • Reviewed and updated as needed. • Tested, including all elements listed in Requirement 12.10.1.
Description

Requirement 12.1.1

Purpose

An overarching information security policy provides the foundation for the entity's security program. It communicates management's commitment to protecting cardholder data and sets the framework for all security activities.

Good Practice

The information security policy should address all PCI DSS requirements and should be disseminated to all relevant personnel. The policy should be endorsed by executive management and should be reviewed at least annually.

Requirement 12.1.2

Purpose

The threat landscape and business environment are constantly evolving. Regular review and update of the information security policy ensures that it remains relevant and effective in addressing current risks and business requirements.

Good Practice

The information security policy should be reviewed at least annually and updated as needed to address changes in business objectives, risks, and regulatory requirements. Reviews should involve relevant stakeholders and should be documented.

Requirement 12.1.3

Purpose

The security policy should clearly define the security responsibilities of all personnel. Without clear definition, individuals may not understand their role in protecting cardholder data and may not take appropriate action.

Good Practice

The security policy should address the information security responsibilities of all personnel, including employees, contractors, and third-party users. It should define acceptable use of technology and specify consequences for policy violations.

Requirement 12.1.4

Purpose

The Chief Information Security Officer (CISO) or equivalent role provides executive-level accountability for the information security program. Without clear executive accountability, the security program may lack the authority and resources needed to be effective.

Good Practice

The CISO or equivalent should have direct responsibility for the entity's information security program. This role should have appropriate authority, access to senior management, and sufficient resources to effectively manage the security program.

12.1: Specific personnel are designated to be available on a 24/7 basis to respond to suspected or confirmed security incidents.
  • Examine documentation and interview responsible personnel occupying designated roles to verify that specific personnel are designated to be available on a 24/7 basis to respond to security incidents.
Description

Requirement 12.1.1

Purpose

An overarching information security policy provides the foundation for the entity's security program. It communicates management's commitment to protecting cardholder data and sets the framework for all security activities.

Good Practice

The information security policy should address all PCI DSS requirements and should be disseminated to all relevant personnel. The policy should be endorsed by executive management and should be reviewed at least annually.

Requirement 12.1.2

Purpose

The threat landscape and business environment are constantly evolving. Regular review and update of the information security policy ensures that it remains relevant and effective in addressing current risks and business requirements.

Good Practice

The information security policy should be reviewed at least annually and updated as needed to address changes in business objectives, risks, and regulatory requirements. Reviews should involve relevant stakeholders and should be documented.

Requirement 12.1.3

Purpose

The security policy should clearly define the security responsibilities of all personnel. Without clear definition, individuals may not understand their role in protecting cardholder data and may not take appropriate action.

Good Practice

The security policy should address the information security responsibilities of all personnel, including employees, contractors, and third-party users. It should define acceptable use of technology and specify consequences for policy violations.

Requirement 12.1.4

Purpose

The Chief Information Security Officer (CISO) or equivalent role provides executive-level accountability for the information security program. Without clear executive accountability, the security program may lack the authority and resources needed to be effective.

Good Practice

The CISO or equivalent should have direct responsibility for the entity's information security program. This role should have appropriate authority, access to senior management, and sufficient resources to effectively manage the security program.

12.1: Personnel responsible for responding to suspected and confirmed security incidents are appropriately and periodically trained on their incident response responsibilities.
  • Examine training documentation and interview incident response personnel to verify that personnel are appropriately and periodically trained on their incident response responsibilities.
Description

Requirement 12.1.1

Purpose

An overarching information security policy provides the foundation for the entity's security program. It communicates management's commitment to protecting cardholder data and sets the framework for all security activities.

Good Practice

The information security policy should address all PCI DSS requirements and should be disseminated to all relevant personnel. The policy should be endorsed by executive management and should be reviewed at least annually.

Requirement 12.1.2

Purpose

The threat landscape and business environment are constantly evolving. Regular review and update of the information security policy ensures that it remains relevant and effective in addressing current risks and business requirements.

Good Practice

The information security policy should be reviewed at least annually and updated as needed to address changes in business objectives, risks, and regulatory requirements. Reviews should involve relevant stakeholders and should be documented.

Requirement 12.1.3

Purpose

The security policy should clearly define the security responsibilities of all personnel. Without clear definition, individuals may not understand their role in protecting cardholder data and may not take appropriate action.

Good Practice

The security policy should address the information security responsibilities of all personnel, including employees, contractors, and third-party users. It should define acceptable use of technology and specify consequences for policy violations.

Requirement 12.1.4

Purpose

The Chief Information Security Officer (CISO) or equivalent role provides executive-level accountability for the information security program. Without clear executive accountability, the security program may lack the authority and resources needed to be effective.

Good Practice

The CISO or equivalent should have direct responsibility for the entity's information security program. This role should have appropriate authority, access to senior management, and sufficient resources to effectively manage the security program.

12.1: The frequency of periodic training for incident response personnel is defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1.
  • Examine the entity’s targeted risk analysis for the frequency of training for incident response personnel to verify the risk analysis was performed in accordance with all elements specified in Requirement 12.3.1.
  • Examine documented results of periodic training of incident response personnel and interview personnel to verify training is performed at the frequency defined in the entity’s targeted risk analysis performed for this requirement.
Description

Requirement 12.1.1

Purpose

An overarching information security policy provides the foundation for the entity's security program. It communicates management's commitment to protecting cardholder data and sets the framework for all security activities.

Good Practice

The information security policy should address all PCI DSS requirements and should be disseminated to all relevant personnel. The policy should be endorsed by executive management and should be reviewed at least annually.

Requirement 12.1.2

Purpose

The threat landscape and business environment are constantly evolving. Regular review and update of the information security policy ensures that it remains relevant and effective in addressing current risks and business requirements.

Good Practice

The information security policy should be reviewed at least annually and updated as needed to address changes in business objectives, risks, and regulatory requirements. Reviews should involve relevant stakeholders and should be documented.

Requirement 12.1.3

Purpose

The security policy should clearly define the security responsibilities of all personnel. Without clear definition, individuals may not understand their role in protecting cardholder data and may not take appropriate action.

Good Practice

The security policy should address the information security responsibilities of all personnel, including employees, contractors, and third-party users. It should define acceptable use of technology and specify consequences for policy violations.

Requirement 12.1.4

Purpose

The Chief Information Security Officer (CISO) or equivalent role provides executive-level accountability for the information security program. Without clear executive accountability, the security program may lack the authority and resources needed to be effective.

Good Practice

The CISO or equivalent should have direct responsibility for the entity's information security program. This role should have appropriate authority, access to senior management, and sufficient resources to effectively manage the security program.

12.1: The security incident response plan includes monitoring and responding to alerts from security monitoring systems, including but not limited to: (a) Intrusion-detection and intrusion-prevention systems, (b) Network security controls, (c) Change-detection mechanisms for critical files, (d) The change-and tamper-detection mechanism for payment pages. This bullet is a best practice until its effective date; refer to Applicability Notes below for details, (e) Detection of unauthorized wireless access points.
  • Examine documentation and observe incident response processes to verify that monitoring and responding to alerts from security monitoring systems are covered in the security incident response plan, including but not limited to the systems specified in this requirement.
Description

Requirement 12.1.1

Purpose

An overarching information security policy provides the foundation for the entity's security program. It communicates management's commitment to protecting cardholder data and sets the framework for all security activities.

Good Practice

The information security policy should address all PCI DSS requirements and should be disseminated to all relevant personnel. The policy should be endorsed by executive management and should be reviewed at least annually.

Requirement 12.1.2

Purpose

The threat landscape and business environment are constantly evolving. Regular review and update of the information security policy ensures that it remains relevant and effective in addressing current risks and business requirements.

Good Practice

The information security policy should be reviewed at least annually and updated as needed to address changes in business objectives, risks, and regulatory requirements. Reviews should involve relevant stakeholders and should be documented.

Requirement 12.1.3

Purpose

The security policy should clearly define the security responsibilities of all personnel. Without clear definition, individuals may not understand their role in protecting cardholder data and may not take appropriate action.

Good Practice

The security policy should address the information security responsibilities of all personnel, including employees, contractors, and third-party users. It should define acceptable use of technology and specify consequences for policy violations.

Requirement 12.1.4

Purpose

The Chief Information Security Officer (CISO) or equivalent role provides executive-level accountability for the information security program. Without clear executive accountability, the security program may lack the authority and resources needed to be effective.

Good Practice

The CISO or equivalent should have direct responsibility for the entity's information security program. This role should have appropriate authority, access to senior management, and sufficient resources to effectively manage the security program.

12.1: The security incident response plan is modified and evolved according to lessons learned and to incorporate industry developments.
  • Examine policies and procedures to verify that processes are defined to modify and evolve the security incident response plan according to lessons learned and to incorporate industry developments.
  • Examine the security incident response plan and interview responsible personnel to verify that the incident response plan is modified and evolved according to lessons learned and to incorporate industry developments.
Description

Requirement 12.1.1

Purpose

An overarching information security policy provides the foundation for the entity's security program. It communicates management's commitment to protecting cardholder data and sets the framework for all security activities.

Good Practice

The information security policy should address all PCI DSS requirements and should be disseminated to all relevant personnel. The policy should be endorsed by executive management and should be reviewed at least annually.

Requirement 12.1.2

Purpose

The threat landscape and business environment are constantly evolving. Regular review and update of the information security policy ensures that it remains relevant and effective in addressing current risks and business requirements.

Good Practice

The information security policy should be reviewed at least annually and updated as needed to address changes in business objectives, risks, and regulatory requirements. Reviews should involve relevant stakeholders and should be documented.

Requirement 12.1.3

Purpose

The security policy should clearly define the security responsibilities of all personnel. Without clear definition, individuals may not understand their role in protecting cardholder data and may not take appropriate action.

Good Practice

The security policy should address the information security responsibilities of all personnel, including employees, contractors, and third-party users. It should define acceptable use of technology and specify consequences for policy violations.

Requirement 12.1.4

Purpose

The Chief Information Security Officer (CISO) or equivalent role provides executive-level accountability for the information security program. Without clear executive accountability, the security program may lack the authority and resources needed to be effective.

Good Practice

The CISO or equivalent should have direct responsibility for the entity's information security program. This role should have appropriate authority, access to senior management, and sufficient resources to effectively manage the security program.

12.1: Incident response procedures are in place, to be initiated upon the detection of stored PAN anywhere it is not expected, and include: (a) Determining what to do if PAN is discovered outside the CDE, including its retrieval, secure deletion, and/or migration into the currently defined CDE, as applicable, (b) Identifying whether sensitive authentication data is stored with PAN, (c) Determining where the account data came from and how it ended up where it was not expected, (d) Remediating data leaks or process gaps that resulted in the account data being where it was not expected.
  • Examine documented incident response procedures to verify that procedures for responding to the detection of stored PAN anywhere it is not expected to exist, ready to be initiated, and include all elements specified in this requirement.
  • Interview personnel and examine records of response actions to verify that incident response procedures are performed upon detection of stored PAN anywhere it is not expected.
Description

Requirement 12.1.1

Purpose

An overarching information security policy provides the foundation for the entity's security program. It communicates management's commitment to protecting cardholder data and sets the framework for all security activities.

Good Practice

The information security policy should address all PCI DSS requirements and should be disseminated to all relevant personnel. The policy should be endorsed by executive management and should be reviewed at least annually.

Requirement 12.1.2

Purpose

The threat landscape and business environment are constantly evolving. Regular review and update of the information security policy ensures that it remains relevant and effective in addressing current risks and business requirements.

Good Practice

The information security policy should be reviewed at least annually and updated as needed to address changes in business objectives, risks, and regulatory requirements. Reviews should involve relevant stakeholders and should be documented.

Requirement 12.1.3

Purpose

The security policy should clearly define the security responsibilities of all personnel. Without clear definition, individuals may not understand their role in protecting cardholder data and may not take appropriate action.

Good Practice

The security policy should address the information security responsibilities of all personnel, including employees, contractors, and third-party users. It should define acceptable use of technology and specify consequences for policy violations.

Requirement 12.1.4

Purpose

The Chief Information Security Officer (CISO) or equivalent role provides executive-level accountability for the information security program. Without clear executive accountability, the security program may lack the authority and resources needed to be effective.

Good Practice

The CISO or equivalent should have direct responsibility for the entity's information security program. This role should have appropriate authority, access to senior management, and sufficient resources to effectively manage the security program.

12.2: Acceptable use policies for end-user technologies are documented and implemented, including: (a) Explicit approval by authorized parties, (b) Acceptable uses of the technology, (c) List of products approved by the company for employee use, including hardware and software.
  • Examine the acceptable use policies for end-user technologies and interview responsible personnel to verify processes are documented and implemented in accordance with all elements specified in this requirement.
Description

Requirement 12.2.1

Purpose

Acceptable use policies help prevent misuse of technologies and reduce the risk of security incidents caused by inappropriate use. Without clear policies, personnel may unknowingly engage in activities that put cardholder data at risk.

Good Practice

Acceptable use policies should cover all end-user technologies, including laptops, tablets, smartphones, removable media, and email. Policies should define acceptable and prohibited activities and should be acknowledged by all users.

Examples

Topics that acceptable use policies should address include approved uses of technology, approved network locations for the technologies, approved products, expected privacy and monitoring of user activities, and prohibited uses of the technologies.

12.3: For each PCI DSS requirement that specifies completion of a targeted risk analysis, the analysis is documented and includes: (a) Identification of the assets being protected, (b) Identification of the threat(s) that the requirement is protecting against, (c) Identification of factors that contribute to the likelihood and/or impact of a threat being realized, (d) Resulting analysis that determines, and includes justification for, how the frequency or processes defined by the entity to meet the requirement minimize the likelihood and/or impact of the threat being realized, (e) Review of each targeted risk analysis at least once every 12 months to determine whether the results are still valid or if an updated risk analysis is needed, (f) Performance of updated risk analyses when needed, as determined by the annual review.
  • Examine documented policies and procedures to verify a process is defined for performing targeted risk analyses for each PCI DSS requirement that specifies completion of a targeted risk analysis, and that the process includes all elements specified in this requirement.
Description

Requirement 12.3.1

Purpose

A formal risk assessment helps organizations identify, prioritize, and manage risks to the cardholder data environment. Without risk assessments, organizations may not be aware of significant risks or may not allocate resources effectively to address them.

Good Practice

Risk assessments should be performed at least annually and whenever significant changes occur to the environment. The assessment should identify critical assets, threats, and vulnerabilities, and should evaluate the likelihood and impact of potential threats.

Definitions

A risk assessment is a systematic process for identifying, analyzing, and evaluating risk to organizational operations, organizational assets, and individuals.

Requirement 12.3.2

Purpose

Targeted risk analyses are performed for specific PCI DSS requirements that allow the entity flexibility in how frequently a control is performed. These analyses help justify the frequency chosen by evaluating the specific risk factors relevant to the control.

Good Practice

Targeted risk analyses should document the assets being protected, the threats and vulnerabilities the control addresses, and the justification for the frequency selected. Analyses should be reviewed at least annually and updated when significant changes occur.

Requirement 12.3.3

Purpose

Cryptographic cipher suites and protocols can become vulnerable over time as new attacks are discovered and computing power increases. Regular review helps ensure that the cryptographic implementations continue to provide adequate protection.

Good Practice

Reviews should be performed at least annually and should assess current cipher suites and protocols against industry standards and recommendations. Weak or deprecated algorithms should be identified and replaced with stronger alternatives.

Requirement 12.3.4

Purpose

Hardware and software technologies have defined lifecycles and may reach end-of-life or end-of-support status. Technologies that are no longer supported by the vendor may not receive security patches, leaving them vulnerable to known exploits.

Good Practice

Organizations should maintain an inventory of hardware and software technologies and monitor vendor announcements regarding end-of-life and end-of-support dates. A plan should be in place to replace or upgrade technologies before they reach end of support.

12.3: A targeted risk analysis is performed for each PCI DSS requirement that the entity meets with the customized approach, to include: (a) Documented evidence detailing each element specified in Appendix D: Customized Approach (including, at a minimum, a controls matrix and risk analysis), (b) Approval of documented evidence by senior management, (c) Performance of the targeted analysis of risk at least once every 12 months.
  • Examine the documented targeted risk- analysis for each PCI DSS requirement that the entity meets with the customized approach to verify that documentation for each requirement exists and is in accordance with all elements specified in this requirement.
Description

Requirement 12.3.1

Purpose

A formal risk assessment helps organizations identify, prioritize, and manage risks to the cardholder data environment. Without risk assessments, organizations may not be aware of significant risks or may not allocate resources effectively to address them.

Good Practice

Risk assessments should be performed at least annually and whenever significant changes occur to the environment. The assessment should identify critical assets, threats, and vulnerabilities, and should evaluate the likelihood and impact of potential threats.

Definitions

A risk assessment is a systematic process for identifying, analyzing, and evaluating risk to organizational operations, organizational assets, and individuals.

Requirement 12.3.2

Purpose

Targeted risk analyses are performed for specific PCI DSS requirements that allow the entity flexibility in how frequently a control is performed. These analyses help justify the frequency chosen by evaluating the specific risk factors relevant to the control.

Good Practice

Targeted risk analyses should document the assets being protected, the threats and vulnerabilities the control addresses, and the justification for the frequency selected. Analyses should be reviewed at least annually and updated when significant changes occur.

Requirement 12.3.3

Purpose

Cryptographic cipher suites and protocols can become vulnerable over time as new attacks are discovered and computing power increases. Regular review helps ensure that the cryptographic implementations continue to provide adequate protection.

Good Practice

Reviews should be performed at least annually and should assess current cipher suites and protocols against industry standards and recommendations. Weak or deprecated algorithms should be identified and replaced with stronger alternatives.

Requirement 12.3.4

Purpose

Hardware and software technologies have defined lifecycles and may reach end-of-life or end-of-support status. Technologies that are no longer supported by the vendor may not receive security patches, leaving them vulnerable to known exploits.

Good Practice

Organizations should maintain an inventory of hardware and software technologies and monitor vendor announcements regarding end-of-life and end-of-support dates. A plan should be in place to replace or upgrade technologies before they reach end of support.

12.3: Cryptographic cipher suites and protocols in use are documented and reviewed at least once every 12 months, including at least the following: (a) An up-to-date inventory of all cryptographic cipher suites and protocols in use, including purpose and where used, (b) Active monitoring of industry trends regarding continued viability of all cryptographic cipher suites and protocols in use, (c) Documentation of a plan, to respond to anticipated changes in cryptographic vulnerabilities.
  • Examine documentation for cryptographic suites and protocols in use and interview personnel to verify the documentation and review is in accordance with all elements specified in this requirement.
Description

Requirement 12.3.1

Purpose

A formal risk assessment helps organizations identify, prioritize, and manage risks to the cardholder data environment. Without risk assessments, organizations may not be aware of significant risks or may not allocate resources effectively to address them.

Good Practice

Risk assessments should be performed at least annually and whenever significant changes occur to the environment. The assessment should identify critical assets, threats, and vulnerabilities, and should evaluate the likelihood and impact of potential threats.

Definitions

A risk assessment is a systematic process for identifying, analyzing, and evaluating risk to organizational operations, organizational assets, and individuals.

Requirement 12.3.2

Purpose

Targeted risk analyses are performed for specific PCI DSS requirements that allow the entity flexibility in how frequently a control is performed. These analyses help justify the frequency chosen by evaluating the specific risk factors relevant to the control.

Good Practice

Targeted risk analyses should document the assets being protected, the threats and vulnerabilities the control addresses, and the justification for the frequency selected. Analyses should be reviewed at least annually and updated when significant changes occur.

Requirement 12.3.3

Purpose

Cryptographic cipher suites and protocols can become vulnerable over time as new attacks are discovered and computing power increases. Regular review helps ensure that the cryptographic implementations continue to provide adequate protection.

Good Practice

Reviews should be performed at least annually and should assess current cipher suites and protocols against industry standards and recommendations. Weak or deprecated algorithms should be identified and replaced with stronger alternatives.

Requirement 12.3.4

Purpose

Hardware and software technologies have defined lifecycles and may reach end-of-life or end-of-support status. Technologies that are no longer supported by the vendor may not receive security patches, leaving them vulnerable to known exploits.

Good Practice

Organizations should maintain an inventory of hardware and software technologies and monitor vendor announcements regarding end-of-life and end-of-support dates. A plan should be in place to replace or upgrade technologies before they reach end of support.

12.3: Hardware and software technologies in use are reviewed at least once every 12 months, including at least the following: (a) Analysis that the technologies continue to receive security fixes from vendors promptly, (b) Analysis that the technologies continue to support (and do not preclude) the entity’s PCI DSS compliance, (c) Documentation of any industry announcements or trends related to a technology, such as when a vendor has announced “end of life” plans for a technology, (d) Documentation of a plan, approved by senior management, to remediate outdated technologies, including those for which vendors have announced “end of life” plans.
  • Examine documentation for the review of hardware and software technologies in use and interview personnel to verify that the review is in accordance with all elements specified in this requirement.
Description

Requirement 12.3.1

Purpose

A formal risk assessment helps organizations identify, prioritize, and manage risks to the cardholder data environment. Without risk assessments, organizations may not be aware of significant risks or may not allocate resources effectively to address them.

Good Practice

Risk assessments should be performed at least annually and whenever significant changes occur to the environment. The assessment should identify critical assets, threats, and vulnerabilities, and should evaluate the likelihood and impact of potential threats.

Definitions

A risk assessment is a systematic process for identifying, analyzing, and evaluating risk to organizational operations, organizational assets, and individuals.

Requirement 12.3.2

Purpose

Targeted risk analyses are performed for specific PCI DSS requirements that allow the entity flexibility in how frequently a control is performed. These analyses help justify the frequency chosen by evaluating the specific risk factors relevant to the control.

Good Practice

Targeted risk analyses should document the assets being protected, the threats and vulnerabilities the control addresses, and the justification for the frequency selected. Analyses should be reviewed at least annually and updated when significant changes occur.

Requirement 12.3.3

Purpose

Cryptographic cipher suites and protocols can become vulnerable over time as new attacks are discovered and computing power increases. Regular review helps ensure that the cryptographic implementations continue to provide adequate protection.

Good Practice

Reviews should be performed at least annually and should assess current cipher suites and protocols against industry standards and recommendations. Weak or deprecated algorithms should be identified and replaced with stronger alternatives.

Requirement 12.3.4

Purpose

Hardware and software technologies have defined lifecycles and may reach end-of-life or end-of-support status. Technologies that are no longer supported by the vendor may not receive security patches, leaving them vulnerable to known exploits.

Good Practice

Organizations should maintain an inventory of hardware and software technologies and monitor vendor announcements regarding end-of-life and end-of-support dates. A plan should be in place to replace or upgrade technologies before they reach end of support.

12.4: Additional requirement for service providers only: Responsibility is established by executive management for the protection of cardholder data and a PCI DSS compliance program to include: (a) Overall accountability for maintaining PCI DSS compliance, (b) Defining a charter for a PCI DSS compliance program and communication to executive management.
  • Additional testing procedure for service provider assessments only: Examine documentation to verify that executive management has established responsibility for the protection of cardholder data and a PCI DSS compliance program in accordance with all elements specified in this requirement.
Description

Requirement 12.4.1

Purpose

For service providers, establishing executive management responsibility for PCI DSS compliance provides accountability and ensures that the compliance program receives appropriate attention and resources at the highest levels of the organization.

Good Practice

Executive management should designate specific responsibility for protecting cardholder data and for PCI DSS compliance. This responsibility should include establishing, documenting, and distributing security policies and procedures.

Requirement 12.4.2

Purpose

Regular reviews of PCI DSS compliance status help service providers maintain ongoing compliance rather than treating it as a point-in-time activity. Quarterly reviews help identify and address compliance gaps before they become significant issues.

Good Practice

Reviews should confirm that personnel are performing their security responsibilities in accordance with documented policies and procedures. Reviews should be documented and should cover all PCI DSS requirements applicable to the service provider.

Requirement 12.4.2.1

Purpose

Documenting the scope of PCI DSS reviews ensures that all in-scope systems and processes are covered. Without clear documentation of scope, some areas may be overlooked during compliance reviews.

Good Practice

Scope documentation should include all system components, network segments, and processes covered by the PCI DSS review. Documentation should be updated whenever changes to the scope occur.

12.4: Additional requirement for service providers only: Reviews are performed at least once every three months to confirm that personnel are performing their tasks in accordance with all security policies and operational procedures. Reviews are performed by personnel other than those responsible for performing the given task and include, but are not limited to, the following tasks: (a) Daily log reviews, (b) Configuration reviews for network security controls, (c) Applying configuration standards to new systems, (d) Responding to security alerts, (e) Change-management processes.
  • Additional testing procedure for service provider assessments only: Examine policies and procedures to verify that processes are defined for conducting reviews to confirm that personnel are performing their tasks in accordance with all security policies and all operational procedures, including but not limited to the tasks specified in this requirement.
  • Additional testing procedure for service provider assessments only: Interview responsible personnel and examine records of reviews to verify that reviews are performed: • At least once every three months. • By personnel other than those responsible for performing the given task.
Description

Requirement 12.4.1

Purpose

For service providers, establishing executive management responsibility for PCI DSS compliance provides accountability and ensures that the compliance program receives appropriate attention and resources at the highest levels of the organization.

Good Practice

Executive management should designate specific responsibility for protecting cardholder data and for PCI DSS compliance. This responsibility should include establishing, documenting, and distributing security policies and procedures.

Requirement 12.4.2

Purpose

Regular reviews of PCI DSS compliance status help service providers maintain ongoing compliance rather than treating it as a point-in-time activity. Quarterly reviews help identify and address compliance gaps before they become significant issues.

Good Practice

Reviews should confirm that personnel are performing their security responsibilities in accordance with documented policies and procedures. Reviews should be documented and should cover all PCI DSS requirements applicable to the service provider.

Requirement 12.4.2.1

Purpose

Documenting the scope of PCI DSS reviews ensures that all in-scope systems and processes are covered. Without clear documentation of scope, some areas may be overlooked during compliance reviews.

Good Practice

Scope documentation should include all system components, network segments, and processes covered by the PCI DSS review. Documentation should be updated whenever changes to the scope occur.

12.4: Additional requirement for service providers only: Reviews conducted in accordance with Requirement 12.4.2 are documented to include: (a) Results of the reviews, (b) Documented remediation actions taken for any tasks that were found to not be performed at Requirement 12.4.2, (c) Review and sign-off of results by personnel assigned responsibility for the PCI DSS compliance program.
  • Additional testing procedure for service provider assessments only: Examine documentation from the reviews conducted in accordance with PCI DSS Requirement 12.4.2 to verify the documentation includes all elements specified in this requirement.
Description

Requirement 12.4.1

Purpose

For service providers, establishing executive management responsibility for PCI DSS compliance provides accountability and ensures that the compliance program receives appropriate attention and resources at the highest levels of the organization.

Good Practice

Executive management should designate specific responsibility for protecting cardholder data and for PCI DSS compliance. This responsibility should include establishing, documenting, and distributing security policies and procedures.

Requirement 12.4.2

Purpose

Regular reviews of PCI DSS compliance status help service providers maintain ongoing compliance rather than treating it as a point-in-time activity. Quarterly reviews help identify and address compliance gaps before they become significant issues.

Good Practice

Reviews should confirm that personnel are performing their security responsibilities in accordance with documented policies and procedures. Reviews should be documented and should cover all PCI DSS requirements applicable to the service provider.

Requirement 12.4.2.1

Purpose

Documenting the scope of PCI DSS reviews ensures that all in-scope systems and processes are covered. Without clear documentation of scope, some areas may be overlooked during compliance reviews.

Good Practice

Scope documentation should include all system components, network segments, and processes covered by the PCI DSS review. Documentation should be updated whenever changes to the scope occur.

12.5: An inventory of system components that are in scope for PCI DSS, including a description of function/use, is maintained and kept current.
  • Examine the inventory to verify it includes all in-scope system components and a description of function/use for each.
  • Interview personnel to verify the inventory is kept current.
Description

Requirement 12.5.1

Purpose

Maintaining an accurate inventory of system components in scope for PCI DSS helps ensure that all components are protected and that none are overlooked. Without an accurate inventory, security controls may not be applied consistently.

Good Practice

The inventory should include all system components that are in scope for PCI DSS, including hardware, software, and network components. The inventory should be kept up to date and verified periodically.

Requirement 12.5.2

Purpose

Documenting and confirming PCI DSS scope ensures that all cardholder data flows and system components are identified and that appropriate security controls are applied. Without proper scoping, components that store, process, or transmit cardholder data may be left unprotected.

Good Practice

PCI DSS scope should be documented and confirmed at least annually and whenever significant changes occur. Scope documentation should include all cardholder data flows, all system components in scope, and the basis for determining scope.

Requirement 12.5.2.1

Purpose

Service providers' environments tend to be more complex and change more frequently. More frequent scope validation helps ensure that all changes are captured and that the PCI DSS scope remains accurate.

Good Practice

Service providers should validate their PCI DSS scope at least every six months and after significant changes. Scope validation should confirm that all cardholder data flows and system components are accurately documented.

Requirement 12.5.3

Purpose

Significant organizational changes can affect PCI DSS scope by introducing new systems, data flows, or processes. Documenting the impact of such changes helps ensure that the scope is updated appropriately and that security controls are maintained.

Good Practice

When significant organizational changes occur, the impact on PCI DSS scope should be documented within a defined timeframe. The documentation should identify any new or changed data flows, systems, or processes and should assess the impact on PCI DSS compliance.

12.5: PCI DSS scope is documented and confirmed by the entity at least once every 12 months and upon significant change to the in-scope environment. At a minimum, the scoping validation includes: (a) Identifying all data flows for the various payment stages (for example, authorization, capture settlement, chargebacks, and refunds) and acceptance channels (for example, card- present, card-not-present, and e-commerce), (b) Updating all data-flow diagrams per Requirement 1.2.4, (c) Identifying all locations where account data is stored, processed, and transmitted, including but not limited to: 1) any locations outside of the currently defined CDE, 2) applications that process CHD, 3) transmissions between systems and networks, and 4) file backups, (d) Identifying all system components in the CDE, connected to the CDE, or that could impact security of the CDE, (e) Identifying all segmentation controls in use and the environment(s) from which the CDE is segmented, including justification for environments being out of scope, (f) Identifying all connections from third-party entities with access to the CDE, (g) Confirming that all identified data flows, account data, system components, segmentation controls, and connections from third parties with access to the CDE are included in scope.
  • Examine documented results of scope reviews and interview personnel to verify that the reviews are performed: • At least once every 12 months. • After significant changes to the in-scope environment.
  • Examine documented results of scope reviews performed by the entity to verify that PCI DSS scoping confirmation activity includes all elements specified in this requirement.
Description

Requirement 12.5.1

Purpose

Maintaining an accurate inventory of system components in scope for PCI DSS helps ensure that all components are protected and that none are overlooked. Without an accurate inventory, security controls may not be applied consistently.

Good Practice

The inventory should include all system components that are in scope for PCI DSS, including hardware, software, and network components. The inventory should be kept up to date and verified periodically.

Requirement 12.5.2

Purpose

Documenting and confirming PCI DSS scope ensures that all cardholder data flows and system components are identified and that appropriate security controls are applied. Without proper scoping, components that store, process, or transmit cardholder data may be left unprotected.

Good Practice

PCI DSS scope should be documented and confirmed at least annually and whenever significant changes occur. Scope documentation should include all cardholder data flows, all system components in scope, and the basis for determining scope.

Requirement 12.5.2.1

Purpose

Service providers' environments tend to be more complex and change more frequently. More frequent scope validation helps ensure that all changes are captured and that the PCI DSS scope remains accurate.

Good Practice

Service providers should validate their PCI DSS scope at least every six months and after significant changes. Scope validation should confirm that all cardholder data flows and system components are accurately documented.

Requirement 12.5.3

Purpose

Significant organizational changes can affect PCI DSS scope by introducing new systems, data flows, or processes. Documenting the impact of such changes helps ensure that the scope is updated appropriately and that security controls are maintained.

Good Practice

When significant organizational changes occur, the impact on PCI DSS scope should be documented within a defined timeframe. The documentation should identify any new or changed data flows, systems, or processes and should assess the impact on PCI DSS compliance.

12.5: Additional requirement for service providers only: PCI DSS scope is documented and confirmed by the entity at least once every six months and upon significant change to the in-scope environment. At a minimum, the scoping validation includes all the elements specified in Requirement 12.5.2.
  • Additional testing procedure for service provider assessments only: Examine documented results of scope reviews and interview personnel to verify that reviews per Requirement 12.5.2 are performed: • At least once every six months, and • After significant changes
  • Additional testing procedure for service provider assessments only: Examine documented results of scope reviews to verify that scoping validation includes all elements specified in Requirement 12.5.2.
Description

Requirement 12.5.1

Purpose

Maintaining an accurate inventory of system components in scope for PCI DSS helps ensure that all components are protected and that none are overlooked. Without an accurate inventory, security controls may not be applied consistently.

Good Practice

The inventory should include all system components that are in scope for PCI DSS, including hardware, software, and network components. The inventory should be kept up to date and verified periodically.

Requirement 12.5.2

Purpose

Documenting and confirming PCI DSS scope ensures that all cardholder data flows and system components are identified and that appropriate security controls are applied. Without proper scoping, components that store, process, or transmit cardholder data may be left unprotected.

Good Practice

PCI DSS scope should be documented and confirmed at least annually and whenever significant changes occur. Scope documentation should include all cardholder data flows, all system components in scope, and the basis for determining scope.

Requirement 12.5.2.1

Purpose

Service providers' environments tend to be more complex and change more frequently. More frequent scope validation helps ensure that all changes are captured and that the PCI DSS scope remains accurate.

Good Practice

Service providers should validate their PCI DSS scope at least every six months and after significant changes. Scope validation should confirm that all cardholder data flows and system components are accurately documented.

Requirement 12.5.3

Purpose

Significant organizational changes can affect PCI DSS scope by introducing new systems, data flows, or processes. Documenting the impact of such changes helps ensure that the scope is updated appropriately and that security controls are maintained.

Good Practice

When significant organizational changes occur, the impact on PCI DSS scope should be documented within a defined timeframe. The documentation should identify any new or changed data flows, systems, or processes and should assess the impact on PCI DSS compliance.

12.5: Additional requirement for service providers only: Significant changes to organizational structure result in a documented (internal) review of the impact to PCI DSS scope and applicability of controls, with results communicated to executive management.
  • Additional testing procedure for service provider assessments only: Examine policies and procedures to verify that processes are defined such that a significant change to organizational structure results in documented review of the impact to PCI DSS scope and applicability of controls.
  • Additional testing procedure for service provider assessments only: Examine documentation (for example, meeting minutes) and interview responsible personnel to verify that significant changes to organizational structure resulted in documented reviews that included all elements specified in this requirement, with results communicated to executive management.
Description

Requirement 12.5.1

Purpose

Maintaining an accurate inventory of system components in scope for PCI DSS helps ensure that all components are protected and that none are overlooked. Without an accurate inventory, security controls may not be applied consistently.

Good Practice

The inventory should include all system components that are in scope for PCI DSS, including hardware, software, and network components. The inventory should be kept up to date and verified periodically.

Requirement 12.5.2

Purpose

Documenting and confirming PCI DSS scope ensures that all cardholder data flows and system components are identified and that appropriate security controls are applied. Without proper scoping, components that store, process, or transmit cardholder data may be left unprotected.

Good Practice

PCI DSS scope should be documented and confirmed at least annually and whenever significant changes occur. Scope documentation should include all cardholder data flows, all system components in scope, and the basis for determining scope.

Requirement 12.5.2.1

Purpose

Service providers' environments tend to be more complex and change more frequently. More frequent scope validation helps ensure that all changes are captured and that the PCI DSS scope remains accurate.

Good Practice

Service providers should validate their PCI DSS scope at least every six months and after significant changes. Scope validation should confirm that all cardholder data flows and system components are accurately documented.

Requirement 12.5.3

Purpose

Significant organizational changes can affect PCI DSS scope by introducing new systems, data flows, or processes. Documenting the impact of such changes helps ensure that the scope is updated appropriately and that security controls are maintained.

Good Practice

When significant organizational changes occur, the impact on PCI DSS scope should be documented within a defined timeframe. The documentation should identify any new or changed data flows, systems, or processes and should assess the impact on PCI DSS compliance.

12.6: A formal security awareness program is implemented to make all personnel aware of the entity’s information security policy and procedures, and their role in protecting the cardholder data.
  • Examine the security awareness program to verify it provides awareness to all personnel about the entity’s information security policy and procedures, and personnel’s role in protecting the cardholder data.
Description

Requirement 12.6.1

Purpose

A formal security awareness program helps ensure that all personnel understand the importance of cardholder data security and their role in protecting it. Without awareness training, personnel may not understand the risks or their security responsibilities.

Good Practice

The security awareness program should be comprehensive and should cover all aspects of information security relevant to the organization. The program should be reviewed and updated annually to reflect current threats and organizational changes.

Requirement 12.6.2

Purpose

Requiring personnel to acknowledge their security responsibilities helps ensure that they have read and understood the security policies and procedures. This also creates a record of acknowledgment that can be used for accountability purposes.

Good Practice

Personnel should review and acknowledge security policies at least annually. Acknowledgments should be documented and retained. New personnel should acknowledge security policies during onboarding.

Requirement 12.6.3

Purpose

Security awareness training helps personnel understand the threats they may encounter and how to respond appropriately. Without regular training, personnel may not be aware of current threats or may forget security practices over time.

Good Practice

Training should be provided upon hire and at least annually thereafter. Training content should be relevant to each person's role and should cover topics such as recognizing social engineering attacks, password security, and reporting security incidents.

Requirement 12.6.3.1

Purpose

Security awareness training should include information about threats specific to the organization's environment, including threats to the CDE. Without targeted threat awareness, personnel may not recognize or respond appropriately to specific threats.

Good Practice

Training should cover current and emerging threats, including phishing, social engineering, and other common attack vectors. Training should be updated regularly to reflect the current threat landscape.

Requirement 12.6.3.2

Purpose

Phishing is one of the most common methods used to compromise credentials and gain unauthorized access. Specific phishing awareness training helps personnel recognize and respond appropriately to phishing attempts.

Good Practice

Phishing awareness training should include examples of phishing emails and techniques, instructions on how to verify suspicious communications, and procedures for reporting phishing attempts. Simulated phishing exercises can help assess the effectiveness of training.

12.6: The security awareness program is: (a) Reviewed at least once every 12 months, and, (b) Updated as needed to address any new threats and vulnerabilities that may impact the security of the entity’s cardholder data and/or sensitive authentication data, or the information provided to personnel about their role in protecting cardholder data.
  • Examine security awareness program content, evidence of reviews, and interview personnel to verify that the security awareness program is in accordance with all elements specified in this requirement.
Description

Requirement 12.6.1

Purpose

A formal security awareness program helps ensure that all personnel understand the importance of cardholder data security and their role in protecting it. Without awareness training, personnel may not understand the risks or their security responsibilities.

Good Practice

The security awareness program should be comprehensive and should cover all aspects of information security relevant to the organization. The program should be reviewed and updated annually to reflect current threats and organizational changes.

Requirement 12.6.2

Purpose

Requiring personnel to acknowledge their security responsibilities helps ensure that they have read and understood the security policies and procedures. This also creates a record of acknowledgment that can be used for accountability purposes.

Good Practice

Personnel should review and acknowledge security policies at least annually. Acknowledgments should be documented and retained. New personnel should acknowledge security policies during onboarding.

Requirement 12.6.3

Purpose

Security awareness training helps personnel understand the threats they may encounter and how to respond appropriately. Without regular training, personnel may not be aware of current threats or may forget security practices over time.

Good Practice

Training should be provided upon hire and at least annually thereafter. Training content should be relevant to each person's role and should cover topics such as recognizing social engineering attacks, password security, and reporting security incidents.

Requirement 12.6.3.1

Purpose

Security awareness training should include information about threats specific to the organization's environment, including threats to the CDE. Without targeted threat awareness, personnel may not recognize or respond appropriately to specific threats.

Good Practice

Training should cover current and emerging threats, including phishing, social engineering, and other common attack vectors. Training should be updated regularly to reflect the current threat landscape.

Requirement 12.6.3.2

Purpose

Phishing is one of the most common methods used to compromise credentials and gain unauthorized access. Specific phishing awareness training helps personnel recognize and respond appropriately to phishing attempts.

Good Practice

Phishing awareness training should include examples of phishing emails and techniques, instructions on how to verify suspicious communications, and procedures for reporting phishing attempts. Simulated phishing exercises can help assess the effectiveness of training.

12.6: Personnel receive security awareness training as follows: (a) Upon hire and at least once every 12 months, (b) Multiple methods of communication are used, (c) Personnel acknowledge at least once every 12 months that they have read and understood the information security policy and procedures.
  • Examine security awareness program records to verify that personnel attend security awareness training upon hire and at least once every 12 months.
  • Examine security awareness program materials to verify the program includes multiple methods of communicating awareness and educating personnel.
  • Interview personnel to verify they have completed awareness training and are aware of their role in protecting cardholder data.
  • Examine security awareness program materials and personnel acknowledgments to verify that personnel acknowledge at least once every 12 months that they have read and understand the information security policy and procedures.
Description

Requirement 12.6.1

Purpose

A formal security awareness program helps ensure that all personnel understand the importance of cardholder data security and their role in protecting it. Without awareness training, personnel may not understand the risks or their security responsibilities.

Good Practice

The security awareness program should be comprehensive and should cover all aspects of information security relevant to the organization. The program should be reviewed and updated annually to reflect current threats and organizational changes.

Requirement 12.6.2

Purpose

Requiring personnel to acknowledge their security responsibilities helps ensure that they have read and understood the security policies and procedures. This also creates a record of acknowledgment that can be used for accountability purposes.

Good Practice

Personnel should review and acknowledge security policies at least annually. Acknowledgments should be documented and retained. New personnel should acknowledge security policies during onboarding.

Requirement 12.6.3

Purpose

Security awareness training helps personnel understand the threats they may encounter and how to respond appropriately. Without regular training, personnel may not be aware of current threats or may forget security practices over time.

Good Practice

Training should be provided upon hire and at least annually thereafter. Training content should be relevant to each person's role and should cover topics such as recognizing social engineering attacks, password security, and reporting security incidents.

Requirement 12.6.3.1

Purpose

Security awareness training should include information about threats specific to the organization's environment, including threats to the CDE. Without targeted threat awareness, personnel may not recognize or respond appropriately to specific threats.

Good Practice

Training should cover current and emerging threats, including phishing, social engineering, and other common attack vectors. Training should be updated regularly to reflect the current threat landscape.

Requirement 12.6.3.2

Purpose

Phishing is one of the most common methods used to compromise credentials and gain unauthorized access. Specific phishing awareness training helps personnel recognize and respond appropriately to phishing attempts.

Good Practice

Phishing awareness training should include examples of phishing emails and techniques, instructions on how to verify suspicious communications, and procedures for reporting phishing attempts. Simulated phishing exercises can help assess the effectiveness of training.

12.6: Security awareness training includes awareness of threats and vulnerabilities that could impact the security of cardholder data and/or sensitive authentication data, including but not limited to: (a) Phishing and related attacks, (b) Social engineering.
  • Examine security awareness training content to verify it includes all elements specified in this requirement.
Description

Requirement 12.6.1

Purpose

A formal security awareness program helps ensure that all personnel understand the importance of cardholder data security and their role in protecting it. Without awareness training, personnel may not understand the risks or their security responsibilities.

Good Practice

The security awareness program should be comprehensive and should cover all aspects of information security relevant to the organization. The program should be reviewed and updated annually to reflect current threats and organizational changes.

Requirement 12.6.2

Purpose

Requiring personnel to acknowledge their security responsibilities helps ensure that they have read and understood the security policies and procedures. This also creates a record of acknowledgment that can be used for accountability purposes.

Good Practice

Personnel should review and acknowledge security policies at least annually. Acknowledgments should be documented and retained. New personnel should acknowledge security policies during onboarding.

Requirement 12.6.3

Purpose

Security awareness training helps personnel understand the threats they may encounter and how to respond appropriately. Without regular training, personnel may not be aware of current threats or may forget security practices over time.

Good Practice

Training should be provided upon hire and at least annually thereafter. Training content should be relevant to each person's role and should cover topics such as recognizing social engineering attacks, password security, and reporting security incidents.

Requirement 12.6.3.1

Purpose

Security awareness training should include information about threats specific to the organization's environment, including threats to the CDE. Without targeted threat awareness, personnel may not recognize or respond appropriately to specific threats.

Good Practice

Training should cover current and emerging threats, including phishing, social engineering, and other common attack vectors. Training should be updated regularly to reflect the current threat landscape.

Requirement 12.6.3.2

Purpose

Phishing is one of the most common methods used to compromise credentials and gain unauthorized access. Specific phishing awareness training helps personnel recognize and respond appropriately to phishing attempts.

Good Practice

Phishing awareness training should include examples of phishing emails and techniques, instructions on how to verify suspicious communications, and procedures for reporting phishing attempts. Simulated phishing exercises can help assess the effectiveness of training.

12.6: Security awareness training includes awareness about the acceptable use of end-user technologies in accordance with Requirement 12.2.1.
  • Examine security awareness training content to verify it includes awareness about acceptable use of end-user technologies in accordance with Requirement 12.2.1.
Description

Requirement 12.6.1

Purpose

A formal security awareness program helps ensure that all personnel understand the importance of cardholder data security and their role in protecting it. Without awareness training, personnel may not understand the risks or their security responsibilities.

Good Practice

The security awareness program should be comprehensive and should cover all aspects of information security relevant to the organization. The program should be reviewed and updated annually to reflect current threats and organizational changes.

Requirement 12.6.2

Purpose

Requiring personnel to acknowledge their security responsibilities helps ensure that they have read and understood the security policies and procedures. This also creates a record of acknowledgment that can be used for accountability purposes.

Good Practice

Personnel should review and acknowledge security policies at least annually. Acknowledgments should be documented and retained. New personnel should acknowledge security policies during onboarding.

Requirement 12.6.3

Purpose

Security awareness training helps personnel understand the threats they may encounter and how to respond appropriately. Without regular training, personnel may not be aware of current threats or may forget security practices over time.

Good Practice

Training should be provided upon hire and at least annually thereafter. Training content should be relevant to each person's role and should cover topics such as recognizing social engineering attacks, password security, and reporting security incidents.

Requirement 12.6.3.1

Purpose

Security awareness training should include information about threats specific to the organization's environment, including threats to the CDE. Without targeted threat awareness, personnel may not recognize or respond appropriately to specific threats.

Good Practice

Training should cover current and emerging threats, including phishing, social engineering, and other common attack vectors. Training should be updated regularly to reflect the current threat landscape.

Requirement 12.6.3.2

Purpose

Phishing is one of the most common methods used to compromise credentials and gain unauthorized access. Specific phishing awareness training helps personnel recognize and respond appropriately to phishing attempts.

Good Practice

Phishing awareness training should include examples of phishing emails and techniques, instructions on how to verify suspicious communications, and procedures for reporting phishing attempts. Simulated phishing exercises can help assess the effectiveness of training.

12.7: Potential personnel who will have access to the CDE are screened, within the constraints of local laws, prior to hire to minimize the risk of attacks from internal sources.
  • Interview responsible Human Resource department management to verify that screening is conducted, within the constraints of local laws, prior to hiring potential personnel who will have access to the CDE.
Description

Requirement 12.7.1

Purpose

Personnel with access to cardholder data or the CDE could potentially misuse that access. Screening potential employees before hire helps identify individuals who may pose a risk to the security of cardholder data.

Good Practice

Screening should be performed for all personnel who will have access to the CDE or cardholder data. The extent of screening should be consistent with the individual's role and the sensitivity of the data they will access. Screening should be performed within the constraints of local laws.

Examples

Screening methods may include background checks, criminal history checks, credit checks, employment verification, and reference checks.

12.8: A list of all third-party service providers (TPSPs) with which account data is shared or that could affect the security of account data is maintained, including a description for each of the services provided.
  • Examine policies and procedures to verify that processes are defined to maintain a list of TPSPs, including a description for each of the services provided, for all TPSPs with whom account data is shared or that could affect the security of account data.
  • Examine documentation to verify that a list of all TPSPs is maintained that includes a description of the services provided.
Description

Requirement 12.8.1

Purpose

Maintaining a list of all third-party service providers (TPSPs) with access to cardholder data or the CDE helps organizations track who has access to their data and systems. Without such a list, organizations may lose track of who has access, making it difficult to manage risk.

Good Practice

The list should include the name of each TPSP, the services provided, and a description of the data or systems they can access. The list should be kept current and reviewed periodically.

Requirement 12.8.2

Purpose

Written agreements with TPSPs establish the responsibilities of each party for protecting cardholder data. Without written agreements, there may be confusion about who is responsible for specific security requirements.

Good Practice

Agreements should clearly define each party's responsibilities for protecting cardholder data and for complying with PCI DSS requirements. Agreements should be reviewed and updated periodically.

Requirement 12.8.3

Purpose

Engaging TPSPs without a proper due diligence process can introduce security risks. Establishing a process for engaging TPSPs helps ensure that security risks are identified and managed before the engagement begins.

Good Practice

The engagement process should include an assessment of the TPSP's security posture, a review of their PCI DSS compliance status, and a risk assessment of the services to be provided. Due diligence should be performed before the engagement and periodically thereafter.

Requirement 12.8.4

Purpose

TPSPs that handle cardholder data must maintain PCI DSS compliance. Monitoring the compliance status of TPSPs helps ensure that they continue to meet their security obligations and that the security of cardholder data is not compromised.

Good Practice

The PCI DSS compliance status of each TPSP should be monitored at least annually. Monitoring methods may include reviewing the TPSP's Attestation of Compliance, reviewing audit reports, or performing onsite assessments.

Requirement 12.8.5

Purpose

Maintaining information about which PCI DSS requirements are managed by each TPSP helps ensure that all requirements are covered and that no gaps exist in the security program. Without this information, organizations may assume that a TPSP is handling requirements that they are not.

Good Practice

A responsibility matrix should be maintained that identifies which PCI DSS requirements are managed by the entity, which are managed by the TPSP, and which are shared. This matrix should be reviewed and updated periodically.

12.8: Written agreements with TPSPs are maintained as follows: (a) Written agreements are maintained with all TPSPs with which account data is shared or that could affect the security of the CDE, (b) Written agreements include acknowledgments from TPSPs that TPSPs are responsible for the security of account data the TPSPs possess or otherwise store, process, or transmit on behalf of the entity, or to the extent that the TPSP could impact the security of the entity’s cardholder data and/or sensitive authentication data.
  • Examine policies and procedures to verify that processes are defined to maintain written agreements with all TPSPs in accordance with all elements specified in this requirement.
  • Examine written agreements with TPSPs to verify they are maintained in accordance with all elements as specified in this requirement.
Description

Requirement 12.8.1

Purpose

Maintaining a list of all third-party service providers (TPSPs) with access to cardholder data or the CDE helps organizations track who has access to their data and systems. Without such a list, organizations may lose track of who has access, making it difficult to manage risk.

Good Practice

The list should include the name of each TPSP, the services provided, and a description of the data or systems they can access. The list should be kept current and reviewed periodically.

Requirement 12.8.2

Purpose

Written agreements with TPSPs establish the responsibilities of each party for protecting cardholder data. Without written agreements, there may be confusion about who is responsible for specific security requirements.

Good Practice

Agreements should clearly define each party's responsibilities for protecting cardholder data and for complying with PCI DSS requirements. Agreements should be reviewed and updated periodically.

Requirement 12.8.3

Purpose

Engaging TPSPs without a proper due diligence process can introduce security risks. Establishing a process for engaging TPSPs helps ensure that security risks are identified and managed before the engagement begins.

Good Practice

The engagement process should include an assessment of the TPSP's security posture, a review of their PCI DSS compliance status, and a risk assessment of the services to be provided. Due diligence should be performed before the engagement and periodically thereafter.

Requirement 12.8.4

Purpose

TPSPs that handle cardholder data must maintain PCI DSS compliance. Monitoring the compliance status of TPSPs helps ensure that they continue to meet their security obligations and that the security of cardholder data is not compromised.

Good Practice

The PCI DSS compliance status of each TPSP should be monitored at least annually. Monitoring methods may include reviewing the TPSP's Attestation of Compliance, reviewing audit reports, or performing onsite assessments.

Requirement 12.8.5

Purpose

Maintaining information about which PCI DSS requirements are managed by each TPSP helps ensure that all requirements are covered and that no gaps exist in the security program. Without this information, organizations may assume that a TPSP is handling requirements that they are not.

Good Practice

A responsibility matrix should be maintained that identifies which PCI DSS requirements are managed by the entity, which are managed by the TPSP, and which are shared. This matrix should be reviewed and updated periodically.

12.8: An established process is implemented for engaging TPSPs, including proper due diligence prior to engagement.
  • Examine policies and procedures to verify that processes are defined for engaging TPSPs, including proper due diligence prior to engagement.
  • Examine evidence and interview responsible personnel to verify the process for engaging TPSPs includes proper due diligence prior to engagement.
Description

Requirement 12.8.1

Purpose

Maintaining a list of all third-party service providers (TPSPs) with access to cardholder data or the CDE helps organizations track who has access to their data and systems. Without such a list, organizations may lose track of who has access, making it difficult to manage risk.

Good Practice

The list should include the name of each TPSP, the services provided, and a description of the data or systems they can access. The list should be kept current and reviewed periodically.

Requirement 12.8.2

Purpose

Written agreements with TPSPs establish the responsibilities of each party for protecting cardholder data. Without written agreements, there may be confusion about who is responsible for specific security requirements.

Good Practice

Agreements should clearly define each party's responsibilities for protecting cardholder data and for complying with PCI DSS requirements. Agreements should be reviewed and updated periodically.

Requirement 12.8.3

Purpose

Engaging TPSPs without a proper due diligence process can introduce security risks. Establishing a process for engaging TPSPs helps ensure that security risks are identified and managed before the engagement begins.

Good Practice

The engagement process should include an assessment of the TPSP's security posture, a review of their PCI DSS compliance status, and a risk assessment of the services to be provided. Due diligence should be performed before the engagement and periodically thereafter.

Requirement 12.8.4

Purpose

TPSPs that handle cardholder data must maintain PCI DSS compliance. Monitoring the compliance status of TPSPs helps ensure that they continue to meet their security obligations and that the security of cardholder data is not compromised.

Good Practice

The PCI DSS compliance status of each TPSP should be monitored at least annually. Monitoring methods may include reviewing the TPSP's Attestation of Compliance, reviewing audit reports, or performing onsite assessments.

Requirement 12.8.5

Purpose

Maintaining information about which PCI DSS requirements are managed by each TPSP helps ensure that all requirements are covered and that no gaps exist in the security program. Without this information, organizations may assume that a TPSP is handling requirements that they are not.

Good Practice

A responsibility matrix should be maintained that identifies which PCI DSS requirements are managed by the entity, which are managed by the TPSP, and which are shared. This matrix should be reviewed and updated periodically.

12.8: A program is implemented to monitor TPSPs’ PCI DSS compliance status at least once every 12 months.
  • Examine policies and procedures to verify that processes are defined to monitor TPSPs’ PCI DSS compliance status at least once every 12 months.
  • Examine documentation and interview responsible personnel to verify that the PCI DSS compliance status of each TPSP is monitored at least once every 12 months.
Description

Requirement 12.8.1

Purpose

Maintaining a list of all third-party service providers (TPSPs) with access to cardholder data or the CDE helps organizations track who has access to their data and systems. Without such a list, organizations may lose track of who has access, making it difficult to manage risk.

Good Practice

The list should include the name of each TPSP, the services provided, and a description of the data or systems they can access. The list should be kept current and reviewed periodically.

Requirement 12.8.2

Purpose

Written agreements with TPSPs establish the responsibilities of each party for protecting cardholder data. Without written agreements, there may be confusion about who is responsible for specific security requirements.

Good Practice

Agreements should clearly define each party's responsibilities for protecting cardholder data and for complying with PCI DSS requirements. Agreements should be reviewed and updated periodically.

Requirement 12.8.3

Purpose

Engaging TPSPs without a proper due diligence process can introduce security risks. Establishing a process for engaging TPSPs helps ensure that security risks are identified and managed before the engagement begins.

Good Practice

The engagement process should include an assessment of the TPSP's security posture, a review of their PCI DSS compliance status, and a risk assessment of the services to be provided. Due diligence should be performed before the engagement and periodically thereafter.

Requirement 12.8.4

Purpose

TPSPs that handle cardholder data must maintain PCI DSS compliance. Monitoring the compliance status of TPSPs helps ensure that they continue to meet their security obligations and that the security of cardholder data is not compromised.

Good Practice

The PCI DSS compliance status of each TPSP should be monitored at least annually. Monitoring methods may include reviewing the TPSP's Attestation of Compliance, reviewing audit reports, or performing onsite assessments.

Requirement 12.8.5

Purpose

Maintaining information about which PCI DSS requirements are managed by each TPSP helps ensure that all requirements are covered and that no gaps exist in the security program. Without this information, organizations may assume that a TPSP is handling requirements that they are not.

Good Practice

A responsibility matrix should be maintained that identifies which PCI DSS requirements are managed by the entity, which are managed by the TPSP, and which are shared. This matrix should be reviewed and updated periodically.

12.8: Information is maintained about which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared between the TPSP and the entity.
  • Examine policies and procedures to verify that processes are defined to maintain information about which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared between both the TPSP and the entity.
  • Examine documentation and interview personnel to verify the entity maintains information about which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared between both entities.
Description

Requirement 12.8.1

Purpose

Maintaining a list of all third-party service providers (TPSPs) with access to cardholder data or the CDE helps organizations track who has access to their data and systems. Without such a list, organizations may lose track of who has access, making it difficult to manage risk.

Good Practice

The list should include the name of each TPSP, the services provided, and a description of the data or systems they can access. The list should be kept current and reviewed periodically.

Requirement 12.8.2

Purpose

Written agreements with TPSPs establish the responsibilities of each party for protecting cardholder data. Without written agreements, there may be confusion about who is responsible for specific security requirements.

Good Practice

Agreements should clearly define each party's responsibilities for protecting cardholder data and for complying with PCI DSS requirements. Agreements should be reviewed and updated periodically.

Requirement 12.8.3

Purpose

Engaging TPSPs without a proper due diligence process can introduce security risks. Establishing a process for engaging TPSPs helps ensure that security risks are identified and managed before the engagement begins.

Good Practice

The engagement process should include an assessment of the TPSP's security posture, a review of their PCI DSS compliance status, and a risk assessment of the services to be provided. Due diligence should be performed before the engagement and periodically thereafter.

Requirement 12.8.4

Purpose

TPSPs that handle cardholder data must maintain PCI DSS compliance. Monitoring the compliance status of TPSPs helps ensure that they continue to meet their security obligations and that the security of cardholder data is not compromised.

Good Practice

The PCI DSS compliance status of each TPSP should be monitored at least annually. Monitoring methods may include reviewing the TPSP's Attestation of Compliance, reviewing audit reports, or performing onsite assessments.

Requirement 12.8.5

Purpose

Maintaining information about which PCI DSS requirements are managed by each TPSP helps ensure that all requirements are covered and that no gaps exist in the security program. Without this information, organizations may assume that a TPSP is handling requirements that they are not.

Good Practice

A responsibility matrix should be maintained that identifies which PCI DSS requirements are managed by the entity, which are managed by the TPSP, and which are shared. This matrix should be reviewed and updated periodically.

12.9: Additional requirement for service providers only: TPSPs provide written agreements to customers that include acknowledgments that TPSPs are responsible for the security of account data the TPSP possesses or otherwise stores, processes, or transmits on behalf of the customer, or to the extent that the TPSP could impact the security of the customer’s cardholder data and/or sensitive authentication data.
  • Additional testing procedure for service provider assessments only: Examine TPSP policies, procedures, and templates used for written agreements to verify processes are defined for the TPSP to provide written acknowledgments to customers in accordance with all elements specified in this requirement.
Description

Requirement 12.9.1

Purpose

TPSPs acknowledging their responsibility for the security of cardholder data helps ensure that both parties understand their obligations. Without such acknowledgment, TPSPs may not be aware of or may dispute their security responsibilities.

Good Practice

TPSPs should provide written acknowledgment that they are responsible for the security of the cardholder data they possess, store, process, or transmit on behalf of the entity. This acknowledgment should be obtained during the engagement process and renewed periodically.

Requirement 12.9.2

Purpose

TPSPs providing information about their PCI DSS compliance status helps their customers assess the security of the services provided and verify that appropriate security controls are in place. This supports the customer's own PCI DSS compliance efforts.

Good Practice

TPSPs should be prepared to provide evidence of their PCI DSS compliance to their customers, including their Attestation of Compliance, relevant sections of their Report on Compliance, or other evidence of compliance as appropriate.

12.9: Additional requirement for service providers only: TPSPs support their customers’ requests for information to meet Requirements 12.8.4 and 12.8.5 by providing the following upon customer request: (a) PCI DSS compliance status information (Requirement 12.8.4), (b) Information about which PCI DSS requirements are the responsibility of the TPSP and which are the responsibility of the customer, including any shared responsibilities (Requirement 12.8.5), for any service the TPSP provides that meets a PCI DSS requirement(s) on behalf of customers or that can impact security of customers’ cardholder data or sensitive authentication data.
  • Additional testing procedure for service provider assessments only: Examine policies and procedures to verify processes are defined for the TPSPs to support customers’ request for information to meet Requirements 12.8.4 and 12.8.5 in accordance with all elements specified in this requirement.
Description

Requirement 12.9.1

Purpose

TPSPs acknowledging their responsibility for the security of cardholder data helps ensure that both parties understand their obligations. Without such acknowledgment, TPSPs may not be aware of or may dispute their security responsibilities.

Good Practice

TPSPs should provide written acknowledgment that they are responsible for the security of the cardholder data they possess, store, process, or transmit on behalf of the entity. This acknowledgment should be obtained during the engagement process and renewed periodically.

Requirement 12.9.2

Purpose

TPSPs providing information about their PCI DSS compliance status helps their customers assess the security of the services provided and verify that appropriate security controls are in place. This supports the customer's own PCI DSS compliance efforts.

Good Practice

TPSPs should be prepared to provide evidence of their PCI DSS compliance to their customers, including their Attestation of Compliance, relevant sections of their Report on Compliance, or other evidence of compliance as appropriate.