PCI DSS Requirement 12: Policies, Risk Analysis, Awareness, TPSPs, and Incident Response

Requirement Structure

Deep Dives

• 12.1.1-12.1.4 - Establish, publish, maintain, and disseminate the information security policy; review at least once every 12 months; define roles and responsibilities; formally assign responsibility to a CISO or other information-security-knowledgeable member of executive management.
• 12.2.1 - Documented and implemented acceptable use policies for end-user technologies (for example remote access, wireless, laptops, mobiles, removable media, email, Internet).
• 12.3.1 - For each PCI DSS requirement that allows flexible or periodic frequency, document a targeted risk analysis: assets protected, threats, likelihood/impact factors, justified frequency, review at least annually, and update when needed (mandatory since 31 March 2025). Underpins controls such as 10.4.2.1, 11.3.1.1, 11.6.1 options, and 12.10.4.1.
• 12.3.3 / 12.3.4 - At least annual inventory and review of cryptographic cipher suites/protocols in use, and of hardware/software technologies (vendor support, EOL plans) (mandatory since 31 March 2025).
• 12.5.1 / 12.5.2 - Maintain an inventory of in-scope system components; confirm PCI DSS scope at least once every 12 months and upon significant change (data flows, CHD locations, CDE/connected/impacting systems, segmentation, third-party connections). This is the entity's activity - not a substitute for assessor scoping.
• 12.6.1-12.6.3 / 12.6.3.1 / 12.6.3.2 - Formal security awareness program; review/update at least annually; train upon hire and at least annually with acknowledgments; include phishing and social engineering awareness; include acceptable use of end-user technologies.
• 12.7.1 - Screen potential personnel who will have access to the CDE prior to hire, within local-law constraints. For store cashiers with access to one card number at a time, screening is a recommendation only.
• 12.8.1-12.8.5 - Maintain a TPSP list; written agreements with security-responsibility acknowledgments (an AOC alone is not enough); due diligence before engagement; monitor TPSP PCI DSS compliance status at least annually; maintain which requirements are managed by the entity, the TPSP, or shared.
• 12.10.1-12.10.6 - Incident response plan covering roles, payment brand/acquirer notification, containment, business recovery, backups, legal reporting, critical systems, and brand procedures; review and test at least annually; designate 24/7 responders; train responders (frequency via 12.10.4.1 TRA); monitor and respond to alerts from IDS/IPS, NSCs, FIM, payment-page tamper detection, and unauthorized wireless; evolve the plan from lessons learned.

How CyberSilo Helps

• Compliance Standards Automation - policy, TRA, scope, TPSP, and IR evidence workflows
• ThreatHawk SIEM and Agentic SOC - feed 12.10.5 monitoring and response evidence from CDE alerts
• USA v4.0.1 readiness services - program-level gap remediation across Requirement 12

Frequently Asked Questions

Is a TPSP's AOC enough for 12.8.2?

No. 12.8.2 requires written agreements that include acknowledgments of security responsibility. Evidence that a TPSP meets PCI DSS (for example an AOC) is not the same as that written agreement.

What is a targeted risk analysis (12.3.1)?

A documented analysis that justifies how frequently a flexible or periodic PCI DSS control must be performed - covering assets, threats, likelihood/impact factors, annual review, and updates when needed. It is not a full enterprise risk assessment substitute.

Does phishing awareness training satisfy 5.4.1?

No. 12.6.3.1 is security awareness training about phishing and social engineering. 5.4.1 is a separate technical/automated control to detect and protect personnel against phishing. Meeting one does not meet the other.

Related PCI Resources

PCI DSS hub · IR plan template · Policy templates · 12 requirements hub · PCI DSS v4.0.1: What Changed