PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/219 of 250
12.3.2Risks to the cardholder data environment are formally identified, evaluated, and managed
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
A targeted risk analysis is performed for each PCI DSS requirement that the entity meets with the customized approach, to include:
- Documented evidence detailing each element specified in Appendix D: Customized Approach (including, at a minimum, a controls matrix and risk analysis).
- Approval of documented evidence by senior management.
- Performance of the targeted analysis of risk at least once every 12 months.
Defined Approach Testing Procedures:
12.3.2 Examine the documented targeted risk?analysis for each PCI DSS requirement that the entity meets with the customized approach to verify that documentation for each requirement exists and is in accordance with all elements specified in this requirement.