PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/215 of 250
12.1.2A comprehensive information security policy that governs and provides direction for protection of the entity’s information assets is known and current
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
The information security policy is:
- Reviewed at least once every 12 months.
- Updated as needed to reflect changes to business objectives or risks to the environment.
Defined Approach Testing Procedures:
12.1.2 Examine the information security policy and interview responsible personnel to verify the policy is managed in accordance with all elements specified in this requirement.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.