PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/230 of 250
12.6.2Security awareness education is an ongoing activity
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
The security awareness program is:
• Reviewed at least once every 12 months, and
• Updated as needed to address any new threats and vulnerabilities that may impact the security of the entity’s CDE, or the information provided to personnel about their role in protecting cardholder data.
Defined Approach Testing Procedures:
12.6.2 Examine security awareness program content, evidence of reviews, and interview personnel to verify that the security awareness program is in accordance with all elements specified in this requirement.