PCI DSS Requirement 12 - Support Information Security with Organizational Policies and Programs

Requirement 12 of PCI DSS asks you to run security as an organized program rather than a set of one-off fixes. That means a written information security policy reviewed every year, a named person responsible for security, targeted risk analyses wherever the standard lets you choose a frequency, security awareness training for all staff, checks on the service providers you share card data with, and a tested incident response plan. Most other requirements point back here, because this is where the policies, people, and paperwork live.

What should the information security policy cover?

Requirement 12.1.1 says you need an overall information security policy that is written, published, kept up to date, and shared with everyone it affects, including relevant vendors and business partners. Requirement 12.1.2 says it is reviewed at least once every 12 months and updated when your business or environment changes. Requirement 12.1.3 says it sets out everyone's security roles and responsibilities, and all staff know and acknowledge them. Requirement 12.1.4 says responsibility for information security is formally given to a chief information security officer or another knowledgeable member of executive management. Nearly every requirement in PCI DSS also has its own policy and procedures item, such as 1.1.1 or 5.1.1, so it helps to organize your policy in the same order and numbering as the standard.

What is a targeted risk analysis?

Some requirements let you choose how often to do something, as long as you justify it. Requirement 12.3.1 says that for each of those, you write a targeted risk analysis that names the assets being protected, the threats the requirement guards against, and what makes those threats more or less likely and serious, then explains the frequency you chose. Each one is reviewed at least once every 12 months. This became mandatory on 31 March 2025. Examples include how often you inspect card terminals (9.5.1.2.1) and how often you review logs for lower-risk systems (10.4.2.1). Requirement 12.3.3, also mandatory since that date, asks you to document the cipher suites and protocols you use and review them at least once every 12 months.

What else has to be documented?

Requirement 12.2.1 asks for acceptable use policies for end-user technologies, such as laptops, phones, removable media, email, and remote access tools. They must require explicit approval to use the technology, define acceptable uses, and list the hardware and software approved for staff. Requirement 12.5.1 asks for an inventory of all system components in PCI DSS scope, with a description of what each one does. Requirement 12.5.2 says you document and confirm your PCI DSS scope at least once every 12 months and after any significant change. That means finding every place card data is stored, processed, or sent, and every system connected to those places.

What security training is required?

Requirement 12.6.1 asks for a formal security awareness program that makes all staff aware of the security policy and their part in protecting card data. Requirement 12.6.3 says staff are trained when hired and at least once every 12 months, and acknowledge at least once every 12 months that they have read and understood the security policy. Since 31 March 2025, the training must cover phishing and social engineering (12.6.3.1) and the acceptable use of end-user technologies (12.6.3.2), and the program itself must be reviewed at least once every 12 months (12.6.2). Requirement 12.7.1 adds that people who will have access to the card data environment are screened before hiring, within the limits of local law.

How should service providers be managed?

Requirement 12.8 covers any service provider you share card data with, or one that could affect the security of your card data. Typical examples are payment gateways, hosting companies, managed IT providers, and call centers. Requirement 12.8.1 asks for a list of them and what each one does. Requirement 12.8.2 asks for written agreements in which they acknowledge responsibility for the security of the card data they handle or could affect. Requirement 12.8.3 asks for due diligence before you engage a new one. Requirement 12.8.4 asks you to check their PCI DSS compliance status at least once every 12 months, usually by getting their current Attestation of Compliance. Requirement 12.8.5 asks you to record which requirements each provider handles, which you handle, and which you share.

What does the incident response plan need?

Requirement 12.10.1 asks for a plan that is ready to use the moment a breach is suspected. It covers roles and contacts, including how to notify the card brands and your acquiring bank, the steps to contain and recover from an incident, business continuity, data backups, and any legal duty to report a breach. Requirement 12.10.2 says the plan is reviewed, updated, and tested at least once every 12 months. Requirement 12.10.3 asks for named people available around the clock to respond. Requirement 12.10.4 says those people are trained, and since 31 March 2025 the training frequency is set by a targeted risk analysis. Requirement 12.10.7, also mandatory since then, asks for procedures to follow if card numbers turn up somewhere they are not supposed to be stored.

Where does an ASV scan fit in?

Your quarterly external scan under Requirement 11.3.2 is part of the evidence that Requirement 12 pulls together. ServerScan is a PCI Approved Scanning Vendor, and every passing scan comes with an Attestation of Scan Compliance report that you can hand to your bank or assessor. The pricing page shows what a plan includes, and our guide to scanning requirements covers the other scans PCI DSS asks for.

Go on to PCI Data Security Standard - What is it?.

Go back to Requirement 11 - Regular Security Testing.