12.1 Establish, publish, maintain, and disseminate a security policy that accomplishes the following: - PCI DSS FAQ - Payment Card Industry (PCI) Data Security Standard Discussion Forum

admin · #1 03-18-2007, 03:35 AM

12.1 Examine the information security policy and verify that the policy is published and disseminated to all relevant system users (including vendors, contractors, and business partners)

ojm37 · #2 01-08-2009, 11:09 AM

Is there somewhere I can go to get an example of a Security Policy for a small shop that doesn't "intentionally" store card data?

needaholiday · #3 11-12-2009, 06:37 AM

When writing a pci policy - do you need to address all requirements in pci-dss standard or those that relate to the SAQ you complete? If you answer N/A to one of the questions on the SAQ do you still need to have this item addressed in your policy?

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
12.6.2 Require employees to acknowledge in writing that they have read and understood the company's security policy and procedures	admin	[PCI-DSS] Requirement 12: Maintain a policy that addresses information security	0	03-18-2007 03:44 AM
12.5.3 Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling of all situations	admin	[PCI-DSS] Requirement 12: Maintain a policy that addresses information security	0	03-18-2007 03:42 AM
12.5.1 Establish, document, and distribute security policies and procedures	admin	[PCI-DSS] Requirement 12: Maintain a policy that addresses information security	0	03-18-2007 03:41 AM
12.4 Ensure that the security policy and procedures clearly define information security responsibilities for all employees and contractors.	admin	[PCI-DSS] Requirement 12: Maintain a policy that addresses information security	0	03-18-2007 03:41 AM
[PCI-DSS] 3.1 Keep cardholder data storage to a minimum. Develop a data retention and disposal policy. Limit storage amount and retention time to that which is required for business, legal, and/or regulatory purposes, as documented in the data retention policy.	admin	[PCI-DSS] Requirement 3: Protect stored cardholder data	0	03-18-2007 02:51 AM