12.1 A comprehensive information security policy is maintained
How to meet it
Establish, publish, review (at least annually) and disseminate the policy.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 12.1, in plain English.
12.1.1An overall information security policy is established, published, maintained, and distributed to relevant personnel, vendors, and partners.
12.1.2The policy is reviewed at least every 12 months and updated for changes to objectives or risks.
12.1.3The policy defines information security roles and responsibilities, which personnel acknowledge.
12.1.4Responsibility for information security is assigned to a CISO or other security-knowledgeable executive.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Information security roles and responsibilitiesUse for ISO 27001 A.5.2, A.5.3 and A.5.4, defining security roles, segregation of duties, management responsibilities, and SOC 2 organisational controls.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.
Open the control-to-policy mapBack to Requirement 12, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.