12.3.1Risks to the cardholder data environment are formally identified, evaluated, and managed

Defined Approach Requirements:

Each PCI DSS requirement that provides flexibility for how frequently it is performed (for example, requirements to be performed periodically) is supported by a targeted risk analysis that is documented and includes:

- Identification of the assets being protected.

- Identification of the threat(s) that the requirement is protecting against.

- Identification of factors that contribute to the likelihood and/or impact of a threat being realized.

- Resulting analysis that determines, and includes justification for, how frequently the requirement must be performed to minimize the likelihood of the threat being realized.

- Review of each targeted risk analysis at least once every 12 months to determine whether the results are still valid or if an updated risk analysis is needed.

- Performance of updated risk analyses when needed, as determined by the annual review.

Defined Approach Testing Procedures:

12.3.1 Examine documented policies and procedures to verify a process is defined for performing targeted risk analyses for each PCI DSS requirement that provides flexibility for how frequently the requirement is performed, and that the process includes all elements specified in this requirement.