27/04/2015 27/04/2015 Requirement 12 Maintain an Information Security Policy: – Review policies and procedures 12.1 Is a security policy established, published, maintained and disseminated to all – relevant personnel Review the information security policy – 12.1.1 Is the security policy reviewed annually and updated when the environment – changes review the policy and interview responsible personnel. – 12.3 Are usage policies for critical technologies (remote access, wireless, laptops, – tablets, removable electronic data, email usage, internet usage) developed to define proper use 12.3.1 Explicit approval by authorised parties to use the technologies Review usage – – policies, interview responsible personnel. 12.3.3 A list of all such devices and personnel with access - Review usage policies, – interview responsible personnel. 12.3.5 Acceptable uses of the technologies - Review usage policies, interview – responsible personnel. 12.4 Do security policy and procedures clearly define information security – responsibilities for all personnel - Review usage policies, interview responsible personnel. 12.5 Are the following information security management responsibilities formally – assigned to an individual or team 12.5.3 Establishing, documenting and distributing security incident response and – escalation procedures to ensure timely and effective handling of all situations - Review usage policies and procedures. 12.6 Is a formal security awareness program in to make all personnel aware of the – importance of cardholder security. Review security awareness program. – 12.8 Are policies and procedures maintained and implemented to manage service – providers with whom cardholder data is shared, or that could affect the security of cardholder data as follows 12.8.1 Maintain a list of service providers, observe agreements. – 12.8.2 Maintain a written agreement with service providers acknowledging their – responsibility for the security of cardholder data. 12.8.3 List the established process for engaging service providers including due – diligence prior to engagement. 12.8.4 Maintain a program to monitor service providers PCI DSS compliance status – annually. 12.8.5 Maintain details about which PCI DSS requirements are managed by each – service provider and which by the entity. 12.10.1 Has an incident response plan been created to be implemented in the event of – system breach Review incident response plan and procedures. –
27/04/2015 27/04/2015 Requirement 12 – Maintain an Information Security Policy: Review policies and procedures 12.1 – Is a security policy established, published, maintained and disseminated to all relevant personnel – Review the information security policy 12.1.1 – Is the security policy reviewed annually and updated when the environment changes – review the policy and interview responsible personnel. 12.3 – Are usage policies for critical technologies (remote access, wireless, laptops, tablets, removable electronic data, email usage, internet usage) developed to define proper use 12.3.1 – Explicit approval by authorised parties to use the technologies – Review usage policies, interview responsible personnel. 12.3.3 – A list of all such devices and personnel with access - Review usage policies, interview responsible personnel. 12.3.5 – Acceptable uses of the technologies - Review usage policies, interview responsible personnel. 12.4 – Do security policy and procedures clearly define information security responsibilities for all personnel - Review usage policies, interview responsible personnel. 12.5 – Are the following information security management responsibilities formally assigned to an individual or team 12.5.3 – Establishing, documenting and distributing security incident response and escalation procedures to ensure timely and effective handling of all situations - Review usage policies and procedures. 12.6 – Is a formal security awareness program in to make all personnel aware of the importance of cardholder security. – Review security awareness program. 12.8 – Are policies and procedures maintained and implemented to manage service providers with whom cardholder data is shared, or that could affect the security of cardholder data as follows 12.8.1 – Maintain a list of service providers, observe agreements. 12.8.2 – Maintain a written agreement with service providers acknowledging their responsibility for the security of cardholder data. 12.8.3 – List the established process for engaging service providers including due diligence prior to engagement. 12.8.4 – Maintain a program to monitor service providers PCI DSS compliance status annually. 12.8.5 – Maintain details about which PCI DSS requirements are managed by each service provider and which by the entity. 12.10.1 – Has an incident response plan been created to be implemented in the event of system breach – Review incident response plan and procedures.
compliance_plan_pcidss_v3.2_0.docx