PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/221 of 250
12.3.4Risks to the cardholder data environment are formally identified, evaluated, and managed
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
Hardware and software technologies in use are reviewed at least once every 12 months, including at least the following:
- Analysis that the technologies continue to receive security fixes from vendors promptly.
- Analysis that the technologies continue to support (and do not preclude) the entity's PCI DSS compliance.
- Documentation of any industry announcements or trends related to a technology, such as when a vendor has announced "end of life" plans for a technology.
- Documentation of a plan, approved by seniormanagement, to remediate outdated technologies, including those for which vendors have announced "end of life" plans.
Defined Approach Testing Procedures:
12.3.4 Examine documentation for the review of hardware and software technologies in use and interview personnel to verify that the review is in accordance with all elements specified in this requirement.