PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/227 of 250
12.5.2.1PCI DSS scope is documented and validated
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
Additional requirement for service providers only: PCI DSS scope is documented and confirmed by the entity at least once every six months and upon significant change to the in-scope environment. At a minimum, the scoping validation includes all the elements specified in Requirement 12.5.2.
Defined Approach Testing Procedures:
12.5.2.1.a Additional testing procedure for service provider assessments only: Examine documented results of scope reviews and interview personnel to verify that reviews per Requirement
12.5.2 are performed:
• At least once every six months, and
• After significant changes