11.6 Are security policies and operational procedures for security Examine security policies and monitoring and testing: operational procedures Documented Interview personnel In use Known to all affected parties? Maintain an Information Security Policy Requirement 12: Maintain a policy that addresses information security for all personnel Note: For the purposes of Requirement 12, refers to full-time part-time employees, temporary employees and personnel, and “personnel” contractors and consultants who are on the entity’s site or otherwise have access to the company’s site cardholder data environment. “resident” Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Not Yes CCW No N/A Tested 12.1 Is a security policy established, published, maintained, and Review the information security disseminated to all relevant personnel? policy 12.1.1 Is the security policy reviewed at least annually and updated Review the information security when the environment changes? policy Interview responsible personnel (a) Is an annual risk assessment process implemented that 12.2 Review annual risk assessment process Identifies critical assets, threats, and vulnerabilities, and Interview personnel Results in a formal, documented analysis of risk? Examples of risk assessment methodologies include but are not limited to OCTAVE, ISO and NIST SP 800-30.
11.6 Are security policies and operational procedures for security monitoring and testing: Documented In use Known to all affected parties? Examine security policies and operational procedures Interview personnel Maintain an Information Security Policy Requirement 12: Maintain a policy that addresses information security for all personnel Note: For the purposes of Requirement 12, “personnel” refers to full-time part-time employees, temporary employees and personnel, and contractors and consultants who are “resident” on the entity’s site or otherwise have access to the company’s site cardholder data environment. PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 12.1 Is a security policy established, published, maintained, and disseminated to all relevant personnel? Review the information security policy 12.1.1 Is the security policy reviewed at least annually and updated when the environment changes? Review the information security policy Interview responsible personnel 12.2 (a) Is an annual risk assessment process implemented that Identifies critical assets, threats, and vulnerabilities, and Results in a formal, documented analysis of risk? Examples of risk assessment methodologies include but are not limited to OCTAVE, ISO and NIST SP 800-30. Review annual risk assessment process Interview personnel
PCI_DSS_v3-1_SAQ_D_Merchant_rev1-1.docx