12.2 Acceptable use policies are defined
How to meet it
Define acceptable use for end-user technologies.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 12.2, in plain English.
12.2.1Acceptable use policies for end-user technologies are documented and implemented, covering approval, acceptable uses, and approved products.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.Acceptable use policyUse for ISO 27001 A.5.10, A.6.3, A.6.4, endpoint controls, remote work, and SOC 2 Security awareness.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.
Open the control-to-policy map← 12.1 A comprehensive information security policy is maintained12.3 Risks to the CDE are formally managed →
Back to Requirement 12, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.