PCI DSS: Information Security Policies

Information Security Policies [Req 12]

Rule: Maintain a policy that addresses information security for all personnel. Support information security with organizational policies and programs.

Requirement 12: Information Security Policy

12.1 — Policy Established and Maintained

Control	Requirement
Written policy	Comprehensive information security policy
Annual review	Review and update at least annually
Management approval	Approved by management
Communicated	Disseminated to all relevant personnel

12.2 — Acceptable Use Policies

Policy	Covers
Technology usage	Acceptable use of all technologies
Remote access	Requirements for remote access
Wireless	Wireless technology usage
Removable media	Laptops, tablets, electronic media
Email/Internet	Acceptable use of communications

12.3 — Risk Assessment

Control	Requirement
Annual assessment	At least once per year
After significant changes	When environment changes
Identify threats	Threats and vulnerabilities
Formal process	Documented methodology

Risk Assessment Must:

• Identify critical assets
• Identify threats to CDE
• Identify vulnerabilities
• Perform formal risk analysis
• Document results

12.4 — Executive Responsibility (Service Providers)

For service providers only:

Control	Requirement
Executive assignment	Executive responsible for PCI DSS
Charter	PCI DSS compliance program charter
Communication	Report to executive management
Quarterly review	Status reviews with management

12.5 — Scope Validation

Control	Requirement
Document scope	CDE and connected systems
Annual validation	Validate scope at least annually
After changes	Revalidate after significant changes
Methodology	Document scoping methodology

Scope Validation Includes:

• All data flows
• All system components
• All connections to/from CDE
• All third-party connections
• All segmentation controls

12.6 — Security Awareness Training

12.6.1 — Training Program

Control	Requirement
Upon hire	Training for new personnel
Annual refresh	At least annual training
Multiple methods	Various delivery methods acceptable
Acknowledgment	Personnel acknowledge training

12.6.2 — Training Content

Training must cover:

• Importance of cardholder data security
• Personnel security responsibilities
• Acceptable use policies
• Phishing and social engineering
• How to report suspicious activity

12.6.3 — Phishing-Specific Training

Control	Requirement
Phishing awareness	How to identify phishing
Reporting procedure	How to report attempts
Simulated attacks	Optional but recommended

12.7 — Personnel Screening

Control	Requirement
Background checks	Prior to hire for CDE access
Scope	Within legal constraints
Examples	Criminal history, credit, references

Note: Screening requirements vary by jurisdiction and role.

12.8 — Third-Party Service Providers

12.8.1 — Provider List

Control	Requirement
Inventory	List of all service providers
Services documented	What services they provide
Annual review	Review list at least annually

12.8.2 — Agreements

Control	Requirement
Written agreement	Documenting responsibilities
Acknowledgment	Provider acknowledges responsibility
PCI DSS requirements	Agree to applicable requirements

12.8.3 — Due Diligence

Control	Requirement
Before engagement	Due diligence before use
Compliance status	Verify provider’s PCI DSS status
Annual review	Monitor compliance status

12.8.4 — Monitor Compliance

Control	Requirement
Annual status	Obtain compliance status annually
AOC review	Review Attestation of Compliance
Track changes	Monitor changes in compliance

12.8.5 — Responsibility Matrix

Control	Requirement
RACI matrix	Who is responsible for what
Clear delineation	No gaps in responsibility
Documented	Written and agreed upon

12.9 — Service Provider Acknowledgment

For service providers:

Control	Requirement
Written acknowledgment	Provide to customers
State responsibility	For security of CHD
PCI DSS requirements	Applicable requirements acknowledged

12.10 — Incident Response

12.10.1 — Incident Response Plan

Element	Requirement
Written plan	Documented procedures
Roles and responsibilities	Who does what
Communication	Internal and external procedures
24/7 coverage	Ability to respond any time

Incident Response Plan Must Include:

• Roles and contact information
• Incident definition and classification
• Response procedures by incident type
• Containment strategies
• Business recovery procedures
• Data backup processes
• Legal/regulatory notification requirements
• Card brand notification procedures
• Lessons learned process

12.10.2 — Annual Review

Control	Requirement
Annual review	Review plan at least annually
Updates	Update as needed
Post-incident	Update after incidents

12.10.3 — Designated Personnel

Control	Requirement
Response team	Designated personnel for response
24/7 availability	Available around the clock
Coverage	For all critical systems

12.10.4 — Training

Control	Requirement
Trained staff	Response personnel trained
Annual training	At least annually
New staff	Trained upon assignment

12.10.5 — Alerts from Security Systems

Control	Requirement
IDS/IPS alerts	Response procedures defined
File integrity	Monitoring alerts addressed
Change detection	Payment page change alerts
Network traffic	Anomaly alerts investigated

12.10.6 — Testing and Evolution

Control	Requirement
Annual testing	Test response plan at least annually
Tabletop exercises	Simulated incident scenarios
Lessons learned	Update plan based on tests
After incidents	Update based on real incidents

Policy Documentation Summary

Policy Area	Review Frequency	Required For
Information security policy	Annual	All entities
Acceptable use policies	Annual	All entities
Risk assessment	Annual + changes	All entities
Scope documentation	Annual + changes	All entities
Service provider agreements	Annual	All entities
Incident response plan	Annual + post-incident	All entities
Security awareness training	Annual	All personnel

Citation

PCI DSS v4.0.1 Requirement 12