Framework № PCI DSS 4.0 от 01.03.2022

Requirement 12: Support Information Security with Organizational Policies and Programs 

Overview:
The organization’s overall information security policy sets the tone for the whole entity and informs personnel what is expected of them. All personnel should be aware of the sensitivity of cardholder data and their responsibilities for protecting it. For the purposes of Requirement 12, “personnel” refers to full-time and part-time employees, temporary employees, contractors, and consultants with security responsibilities for protecting account data or that can impact the security of account data. 

12.1 A comprehensive information security policy that governs and provides direction for protection of the entity’s information assets is known and current.