12.3 Risks to the CDE are formally managed
How to meet it
Perform targeted risk analyses where the standard allows flexibility.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 12.3, in plain English.
12.3.1Each requirement needing a targeted risk analysis has one documented, covering assets, threats, likelihood/impact, and justified frequency, reviewed annually.
12.3.2A targeted risk analysis is performed for each requirement met using the customized approach, with senior management approval.
12.3.3Cryptographic cipher suites and protocols are documented and reviewed at least every 12 months.
12.3.4Hardware and software technologies are reviewed at least every 12 months for end-of-life and support, with a remediation plan.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.Vulnerability and patch management policyUse for ISO 27001 A.8.8, A.8.19, A.8.32, SOC 2 Security, and PCI DSS requirements 6 and 11.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.
Open the control-to-policy mapBack to Requirement 12, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.