PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/249 of 250
12.10.7Suspected and confirmed security incidents that could impact the CDE are responded to immediately
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
Incident response procedures are in place, to be initiated upon the detection of stored PAN anywhere it is not expected, and include:
- Determining what to do if PAN is discovered outside the CDE, including its retrieval, secure deletion, and/or migration into the currently defined CDE, as applicable.
- Identifying whether sensitive authentication data is stored with PAN.
- Determining where the account data came from and how it ended up where it was not expected.
- Remediating data leaks or process gaps that resulted in the account data being where it was not expected.
Defined Approach Testing Procedures:
12.10.7.a Examine documented incident response procedures to verify that procedures for responding to the detection of stored PAN anywhere it is not expected to exist, ready to be initiated, and include all elements specified in this requirement.
12.10.7.b Interview personnel and examine records of response actions to verify that incident response procedures are performed upon detection of stored PAN anywhere it is not expected.