PCI Requirement 12.5 – Assign to an Individual or Team the Following Information Security Management Responsibilities

by Randy Bartels / December 22, 2022

 Assigning Information Security Management Responsibilities Building a PCI compliance program takes teamwork. PCI Requirement 12.5 recognizes this and requires that you assign an individual or team to the following information security management responsibilities: Establish, document, and distribute security policies and procedures Monitor and analyze security alerts and information, and distribute to appropriate personnel Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling…

PCI Requirement 12.4.1 – Additional Requirement for Service Providers Only: Executive Management Shall Establish Responsibility for the Protection of Cardholder Data and a PCI DSS Compliance Program

by Randy Bartels / May 10, 2023

 Tone from the Top PCI Requirement 12.4.1 is a sub-requirement of PCI Requirement 12 and applies to service providers only. It requires that executive management shall establish responsibility for the protection of cardholder data and a PCI DSS compliance program, which includes overall accountability for maintaining PCI compliance and defining a charter for a PCI DSS compliance program and communication to executive management. PCI Requirement 12.4.1 is vital for…

PCI Requirement 12.4 – Ensure Security Policies and Procedures Clearly Define Information Security Responsibilities for All Personnel

by Randy Bartels / December 22, 2022

 Security Responsibilities PCI Requirement 12.4 establishes the requirement to ensure that the security policy and procedures clearly define information security responsibilities for all personnel. Anyone with access to cardholder data will have some level of security responsibility, and they must be aware of that. The PCI DSS guidance explains, “Without clearly defined security roles and responsibilities assigned, there could be inconsistent interaction with the security group, leading to unsecured…

PCI Requirement 12.3.10 – For Personnel Accessing Cardholder Data via Remote-Access Technologies, Prohibit the Copying, Moving, and Storage of Cardholder Data onto Local Hard Drives and Removable Electronic Media

by Randy Bartels / December 22, 2022

 Employees with Remote-Access If you have employees who can access your cardholder data environment from remote-access technologies, you must comply with PCI Requirement 12.3.10. It states, “For personnel accessing cardholder data via remote-access technologies, prohibit the copying, moving, and storage of cardholder data onto local hard drives and removable electronic media, unless explicitly authorized for a defined business need. Where there is an authorized business need, the usage policies…

PCI Requirement 12.3.9 – Activation of Remote-Access Technologies for Vendors and Business Partners Only When Needed

by Randy Bartels / December 22, 2022

 Vendor Management in Usage Policies Organizations on the road to PCI compliance must recognize the importance of vendor management. Your usage policies should include a vendor management aspect, outlined by PCI Requirement 12.3.9, “Activation of remote-access technologies for vendors and business partners only when needed by vendors and business partners, with immediate deactivation after use.” Wherever you have vendors and business partners come into your environment, we’re going to…