PCI DSS Incident Response Plan Template (Requirement 12.10)

IR Plan Template Sections

1. Purpose / scope - CDE and connected systems
2. Definitions - suspected vs confirmed account data compromise
3. Roles and 24/7 contact tree (12.10.3)
4. Detection sources - IDS/NSC/FIM/payment-page tamper/unauthorized wireless (ties to 12.10.5)
5. Severity / triage
6. Containment, eradication, recovery
7. Evidence preservation / PFI engagement triggers
8. Notification matrix - acquirer, brands, regulators (for example CBUAE 72-hour duties where Article 18 applies to Card Schemes), customers, law enforcement
9. Business continuity / backups
10. Communications - legal-approved messaging
11. Post-incident review - update the plan (12.10.6)
12. Training cadence (12.10.4 / TRA 12.10.4.1)
13. Annual test record appendix

Close each tabletop with owners, findings, and plan revision dates so assessors can sample the operating cycle.

How CyberSilo Helps

• IR playbooks and detection evidence via ThreatHawk and Agentic SOC
• Plan-to-control linkage in CSA
• Tabletop facilitation as part of PCI readiness engagements

Frequently Asked Questions

Is a PFI always required?

Brand and acquirer programs dictate PFI engagement after confirmed account data compromise. Document the trigger in the plan.

Can a SOC runbook replace this plan?

SOC runbooks feed the plan; Requirement 12.10 still needs the documented entity IR plan and annual test record.

Does CBUAE 72-hour notice apply to every UAE merchant?

Article 18 paragraph 22 is a Card Scheme duty under Circular C 15/2021. Merchants still follow brand/acquirer notice rules - and any other licence-specific regulator duties that apply to them.

Related PCI Resources

Requirement 12 · Policy templates · Fines · Evidence list · Agentic SOC · UAE and KSA