PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/243 of 250
12.10.2Suspected and confirmed security incidents that could impact the CDE are responded to immediately
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
At least once every 12 months, the security incident response plan is:
- Reviewed and the content is updated as needed.
- Tested, including all elements listed in Requirement 12.10.1.
Defined Approach Testing Procedures:
12.10.2 Interview personnel and review
documentation to verify that, at least once every 12 months, the security incident response plan is:
- Reviewed and updated as needed.
- Tested, including all elements listed in Requirement 12.10.1
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.