PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/232 of 250
12.6.3.1Security awareness education is an ongoing activity
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
Security awareness training includes awareness of threats and vulnerabilities that could impact the security of the CDE, including but not limited to:
• Phishing and related attacks.
• Social engineering.
Defined Approach Testing Procedures
12.6.3.1 Examine security awareness training content to verify it includes all elements specified in this requirement.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.