12.1.1 Is the security policy reviewed at annually and Review the information security policy updated when the environment changes? Interview responsible personnel 12.4 Do security policy and procedures clearly define Review information security policy and information security responsibilities for all personnel? procedures Interview a sample of responsible personnel Are the following information security management 12.5 responsibilities formally assigned to an individual or team: Establishing, documenting, and distributing security 12.5.3 Review information security policy and incident response and escalation procedures to ensure procedures timely and effective handling of all situations? Is a formal security awareness program in place to 12.6 Review security awareness program make all personnel aware of the cardholder data security policy and procedures? 12.8 Are policies and procedures maintained and implemented to manage service providers with whom cardholder data is shared, or that could affect the security of cardholder data, as follows: 12.8.1 Is a list of service providers maintained, including a Review policies and procedures description of the service(s) provided? Observe processes Review list of service providers
12.1.1 Is the security policy reviewed at annually and updated when the environment changes? Review the information security policy Interview responsible personnel 12.4 Do security policy and procedures clearly define information security responsibilities for all personnel? Review information security policy and procedures Interview a sample of responsible personnel 12.5 Are the following information security management responsibilities formally assigned to an individual or team: 12.5.3 Establishing, documenting, and distributing security incident response and escalation procedures to ensure timely and effective handling of all situations? Review information security policy and procedures 12.6 Is a formal security awareness program in place to make all personnel aware of the cardholder data security policy and procedures? Review security awareness program 12.8 Are policies and procedures maintained and implemented to manage service providers with whom cardholder data is shared, or that could affect the security of cardholder data, as follows: 12.8.1 Is a list of service providers maintained, including a description of the service(s) provided? Review policies and procedures Observe processes Review list of service providers