Are the following information security management responsibilities formally assigned to an individual or team: documenting, and distributing security policies Review information security policy and procedures? and procedures and analyzing security alerts and information, and Review information security policy distributing to appropriate personnel? and procedures documenting, and distributing security incident Review information security policy response and escalation procedures to ensure timely and and procedures effective handling of all situations? user accounts, including additions, deletions, Review information security policy and modifications? and procedures and controlling all access to data? Review information security policy and procedures Is a formal security awareness program in place to 12.6 Review security awareness make all personnel aware of the importance of program cardholder data security? Do security awareness program procedures include the following: 12.6.1 Does the security awareness program provide Review security awareness multiple methods of communicating awareness and program educating personnel (for example, posters, letters, Review security awareness memos, web based training, meetings, and program procedures promotions)? Review security awareness Note: Methods can vary depending on the role of the program attendance records personnel and their level of access to the cardholder data. Are personnel educated upon hire and at least Examine security awareness annually? program procedures and documentation Have employees completed awareness training and Interview personnel are they aware of the importance of cardholder data security?
Are the following information security management responsibilities formally assigned to an individual or team: documenting, and distributing security policies and procedures? Review information security policy and procedures and analyzing security alerts and information, and distributing to appropriate personnel? Review information security policy and procedures documenting, and distributing security incident response and escalation procedures to ensure timely and effective handling of all situations? Review information security policy and procedures user accounts, including additions, deletions, and modifications? Review information security policy and procedures and controlling all access to data? Review information security policy and procedures 12.6 Is a formal security awareness program in place to make all personnel aware of the importance of cardholder data security? Review security awareness program Do security awareness program procedures include the following: 12.6.1 Does the security awareness program provide multiple methods of communicating awareness and educating personnel (for example, posters, letters, memos, web based training, meetings, and promotions)? Note: Methods can vary depending on the role of the personnel and their level of access to the cardholder data. Review security awareness program Review security awareness program procedures Review security awareness program attendance records Are personnel educated upon hire and at least annually? Examine security awareness program procedures and documentation Have employees completed awareness training and are they aware of the importance of cardholder data security? Interview personnel