12.4 PCI DSS compliance is managed
How to meet it
Assign responsibility for the compliance program (and, for service providers, executive oversight).
Defined requirements
The individual PCI DSS v4.0.1 requirements under 12.4, in plain English.
12.4.1Service providers: executive management establishes accountability for protecting cardholder data and a PCI DSS compliance program.
12.4.2Service providers: independent reviews at least quarterly confirm security tasks are being performed.
12.4.2.1Service providers: those reviews are documented with results, remediation, and sign-off.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Information security roles and responsibilitiesUse for ISO 27001 A.5.2, A.5.3 and A.5.4, defining security roles, segregation of duties, management responsibilities, and SOC 2 organisational controls.Vulnerability and patch management policyUse for ISO 27001 A.8.8, A.8.19, A.8.32, SOC 2 Security, and PCI DSS requirements 6 and 11.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Cloud services and outsourcing policyUse for ISO 27001 A.5.19 to A.5.23, SOC 2 vendor management, and oversight of cloud and outsourced service providers.
Open the control-to-policy mapBack to Requirement 12, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.