PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/248 of 250
12.10.6Suspected and confirmed security incidents that could impact the CDE are responded to immediately
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
The security incident response plan is modified and evolved according to lessons learned and to incorporate industry developments.
Defined Approach Testing Procedures:
12.10.6.a Examine policies and procedures to verify that processes are defined to modify and evolve the security incident response plan according to lessons learned and to incorporate industry developments.
12.10.6.b Examine the security incident response plan and interview responsible personnel to verify that the incident response plan is modified and evolved according to lessons learned and to incorporate industry developments.