PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/214 of 250
12.1.1A comprehensive information security policy that governs and provides direction for protection of the entity’s information assets is known and current
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
An overall information security policy is:
- Established.
- Published.
- Maintained.
- Disseminated to all relevant personnel, as well as to relevant vendors and business partners.
Defined Approach Testing Procedures:
12.1.1 Examine the information security policy and interview personnel to verify that the overall information security policy is managed in accordance with all elements specified in this requirement.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.