Framework № PCI DSS 4.0 от 01.03.2022

12.1.1
Defined Approach Requirements: 
An overall information security policy is:

Customized Approach Objective:
The strategic objectives and principles of information security are defined, adopted, and known to all personnel. 

Defined Approach Testing Procedures:

Purpose:
An organization’s overall information security policy ties to and governs all other policies and procedures that define protection of cardholder data. 
The information security policy communicates management’s intent and objectives regarding the protection of its most valuable assets, including cardholder data. 
Without an information security policy, individuals will make their own value decisions on the controls that are required within the organization which may result in the organization neither meeting its legal, regulatory, and contractual obligations, nor being able to adequately protect its assets in a consistent manner. 
To ensure the policy is implemented, it is important that all relevant personnel within the organization, as well as relevant third parties, vendors, and business partners are aware of the organization’s information security policy and their responsibilities for protecting information assets. 

Good Practice:
The security policy for the organization identifies the purpose, scope, accountability, and information that clearly defines the organization’s position regarding information security. 
The overall information security policy differs from individual security policies that address specific technology or security disciplines. This policy sets forth the directives for the entire organization whereas individual security policies align and support the overall security policy and communicate specific objectives for technology or security disciplines. 
It is important that all relevant personnel within the organization, as well as relevant third parties, vendors, and business partners are aware of the organization’s information security policy and their responsibilities for protecting information assets. 

Definitions:
“Relevant” for this requirement means that the information security policy is disseminated to those with roles applicable to some or all the topics in the policy, either within the company or because of services/functions performed by a vendor or third party 

12.1.2
Defined Approach Requirements: 
The information security policy is:

Customized Approach Objective:
The information security policy continues to reflect the organization’s strategic objectives and principles. 

Defined Approach Testing Procedures:

Purpose:
Security threats and associated protection methods evolve rapidly. Without updating the information security policy to reflect relevant changes, new measures to defend against these threats may not be addressed. 

12.1.3
Defined Approach Requirements: 
The security policy clearly defines information security roles and responsibilities for all personnel, and all personnel are aware of and acknowledge their information security responsibilities. 

Customized Approach Objective:
Personnel understand their role in protecting the entity’s cardholder data. 

Defined Approach Testing Procedures:

Purpose:
Without clearly defined security roles and responsibilities assigned, there could be misuse of the organization’s information assets or inconsistent interaction with information security personnel, leading to insecure implementation of technologies or use of outdated or insecure technologies. 

12.1.4
Defined Approach Requirements: 
Responsibility for information security is formally assigned to a Chief Information Security Officer or other information security knowledgeable member of executive management. 

Customized Approach Objective:
A designated member of executive management is responsible for information security. 

Defined Approach Testing Procedures:

Purpose:
To ensure someone with sufficient authority and responsibility is actively managing and championing the organization’s information security program, accountability and responsibility for information security needs to be assigned at the executive level within an organization. 
Common executive management titles for this role include Chief Information Security Officer (CISO) and Chief Security Officer (CSO – to meet this requirement, the CSO role must be responsible for information security). These positions are often at the most senior level of management and are part of the chief executive level or C-level, typically reporting to the Chief Executive Officer or the Board of Directors. 

Good Practice:
Entities should also consider transition and/or succession plans for these key personnel to avoid potential gaps in critical security activities.