10.7 Failures of critical security controls are detected and responded to
How to meet it
Alert on and promptly respond to failures of security controls.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 10.7, in plain English.
10.7.1Service providers detect, alert on, and promptly address failures of critical security control systems.
10.7.2All entities detect, alert on, and promptly address failures of critical security control systems.
10.7.3Failures of critical controls are responded to promptly, including restoring functions and root-cause remediation.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Vulnerability and patch management policyUse for ISO 27001 A.8.8, A.8.19, A.8.32, SOC 2 Security, and PCI DSS requirements 6 and 11.Cloud services and outsourcing policyUse for ISO 27001 A.5.19 to A.5.23, SOC 2 vendor management, and oversight of cloud and outsourced service providers.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.
Open the control-to-policy mapBack to Requirement 10, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.