PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/224 of 250

12.4.2.1PCI DSS compliance is managed

Control family: Requirement 12: Support Information Security with Organizational Policies and Programs

Control description

Additional requirement for service providers only: Reviews conducted in accordance with Requirement 12.4.2 are documented to include:

• Results of the reviews.

• Documented remediation actions taken for any tasks that were found to not be performed at Requirement 12.4.2.

• Review and sign-off of results by personnel assigned responsibility for the PCI DSS compliance program.

Defined Approach Testing Procedures:

12.4.2.1 Additional testing procedure for service provider assessments only: Examine documentation from the reviews conducted in accordance with PCI DSS Requirement 12.4.2 to verify the documentation includes all elements specified in this requirement.

How to implement

Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.