PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/250 of 250
12.1.4A comprehensive information security policy that governs and provides direction for protection of the entity’s information assets is known and current
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
Responsibility for information security is formally assigned to a Chief Information Security Officer or other information security knowledgeable member of executive management.
Defined Approach Testing Procedures:
12.1.4 Examine the information security policy to verify that information security is formally assigned to a Chief Information Security Officer or other information security-knowledgeable member of executive management.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.