12.5 PCI DSS scope is documented and validated
How to meet it
Document and confirm scope at least annually and on significant change.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 12.5, in plain English.
12.5.1An inventory of in-scope system components with their function is maintained and kept current.
12.5.2PCI DSS scope is documented and confirmed at least every 12 months and on significant change.
12.5.2.1Service providers confirm scope at least every six months and on significant change.
12.5.3Service providers: significant organizational changes trigger a documented review of scope impact.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.Cloud services and outsourcing policyUse for ISO 27001 A.5.19 to A.5.23, SOC 2 vendor management, and oversight of cloud and outsourced service providers.
Open the control-to-policy mapBack to Requirement 12, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.