PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/217 of 250
12.2.1Acceptable use policies for end-user technologies are defined and implemented
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
Acceptable use policies for end-user technologies are documented and implemented, including:
- Explicit approval by authorized parties.
- Acceptable uses of the technology.
- List of products approved by the company for employee use, including hardware and software.
Defined Approach Testing Procedures:
12.2.1 Examine the acceptable use policies for end-user technologies and interview responsible personnel to verify processes are documented and implemented in accordance with all elements specified in this requirement.