Requirement 12: Support Information Security with Organizational Policies and Programs
A security policy must be established and made known to all relevant personnel. It must be updated annually and whenever significant changes occur. Keep in mind that for almost every requirement of the PCI DSS, you are required to have a corresponding policy to ensure that the requirement is maintained. Therefore, it is a good idea to structure your information security policy to match the order, numbering scheme, and language of the PCI DSS requirements and sub requirements. Doing this will make your information security policy easier to navigate and reference. It will also help your PCI DSS assessments to go smoothly.
A documented targeted risk analysis must be performed at the frequency your organization defines for each requirement that calls for one (Requirement 12.3.1), to identify critical assets, threats, and vulnerabilities. Related: 12.3.2 covers targeted risk analyses for the customized approach, 12.3.3 the annual cryptographic-suite review, and 12.3.4 the technology review for service providers.
Acceptable-use policies should be established for critical technologies (Requirement 12.2.1). These policies help to ensure that remote access devices and technologies are used only in approved ways.
Information security responsibilities should be defined clearly in the security policy (see 12.4 and 12.5 for more detail on this). Service providers must also define a charter for a PCI DSS compliance program and assign overall accountability for maintaining compliance with the PCI DSS.
A formal security awareness training program must be used to ensure that all employees are trained upon hire and at least annually on the importance of cardholder data security. Training must also cover phishing and other social-engineering attacks (Requirement 12.6.3.1) and acceptable use (Requirement 12.6.3.2), and the training program itself must be reviewed at least annually (Requirement 12.6.2). Multiple methods of training should be in place, such as security awareness posters, email notifications, and/or computer-based training.
Screen new employees (or employees promoted to a role that requires access the CDE) with background checks to minimize the risk of attacks from inside sources.
Use a vendor management program to ensure that PCI Compliance is verified annually for all partners and service providers with whom cardholder data is sent, or who could impact the security of your cardholder data.
Establish an incident response plan, and test it at least annually. Specific incident response plan requirements are listed in requirement 12.10.
Go on to PCI Data Security Standard - What is it?.
Go back to Requirement 11 - Regular Security Testing.