Requirement 12 covers the security policy and program: risk analysis, compliance management, scope validation, awareness, screening, third parties and incident response. Each page covers one second-level requirement.
Requirement 12.1 requires an information security policy that is published, disseminated, reviewed at least every 12 months, defines security roles for all personnel, and assigns overall responsibility to a CISO or executive.
Requirement 12.2 requires acceptable use policies for end-user technologies such as remote access, wireless, laptops, phones, removable media, email and internet, with approval, acceptable uses and approved product lists.
Requirement 12.3 covers targeted risk analyses for requirements with flexible frequencies or the customized approach, plus yearly reviews of cryptographic cipher suites and protocols and of hardware and software technologies in use.
Requirement 12.4 makes PCI DSS compliance a managed program: for service providers, executive accountability with a charter, and quarterly reviews confirming personnel are performing security tasks such as log reviews and change management.
Requirement 12.5 documents and validates PCI DSS scope: an inventory of in-scope system components, an entity-performed scope confirmation every 12 months (six months for service providers), and review of scope after organizational changes.
Requirement 12.6 requires an ongoing security awareness program, reviewed yearly, with training on phishing, social engineering and acceptable use, and yearly acknowledgment of the security policy by all personnel.
Requirement 12.7 requires screening of potential personnel who will have access to the CDE before hire, within local law, to reduce insider threats.
Requirement 12.8 manages risk from third-party service providers: a TPSP list, written agreements acknowledging security responsibility, due diligence before engagement, yearly monitoring of compliance status, and a responsibility matrix.
Requirement 12.9 is the service provider side of 12.8: TPSPs acknowledge in writing their responsibility for customers' account data and provide compliance status and responsibility information when customers ask.
Requirement 12.10 requires an incident response plan that is tested yearly, staffed 24/7, covers alerts from security monitoring systems, evolves from lessons learned, and includes procedures for PAN found where it should not be.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.