PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/242 of 250
12.10.1Suspected and confirmed security incidents that could impact the CDE are responded to immediately
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
An incident response plan exists and is ready to be activated in the event of a suspected or confirmed security incident. The plan includes, but is not limited to:
- Roles, responsibilities, and communication andcontact strategies in the event of a suspected or confirmed security incident, including notification of payment brands and acquirers, at a minimum.
- Incident response procedures with specific containment and mitigation activities for different types of incidents.
- Business recovery and continuity procedures.
- Data backup processes.
- Analysis of legal requirements for reporting compromises.
- Coverage and responses of all critical system components.
- Reference or inclusion of incident response procedures from the payment brands.
Defined Approach Testing Procedures:
12.10.1.a Examine the incident response plan to verify that the plan exists and includes at least the elements specified in this requirement.
12.10.1.b Interview personnel and examine documentation from previously reported incidents or alerts to verify that the documented incident response plan and procedures were followed.