PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/244 of 250
12.10.3Suspected and confirmed security incidents that could impact the CDE are responded to immediately
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
Specific personnel are designated to be available on a 24/7 basis to respond to suspected or confirmed security incidents.
Defined Approach Testing Procedures:
12.10.3 Examine documentation and interview responsible personnel occupying designated roles to verify that specific personnel are designated to be available on a 24/7 basis to respond to security incidents.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.