12.7 Personnel are screened
How to meet it
Screen staff before hire to reduce insider risk, within local law.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 12.7, in plain English.
12.7.1Personnel who will access the CDE are screened before hire, within local law, to reduce insider risk.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Physical and environmental security policyUse for ISO 27001 A.7.1 to A.7.14, SOC 2 Security, and PCI DSS requirement 9 physical access controls.Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.
Open the control-to-policy map← 12.6 Security awareness education is ongoing12.8 Third-party service provider (TPSP) risk is managed →
Back to Requirement 12, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.