12.1.3 The security policy clearly defines information security roles and responsibilities for all personnel, and all personnel are aware of and acknowledge their information security responsibilities.

Defined Approach Requirements

12.1.3 The security policy clearly defines information security roles and responsibilities for all personnel, and all personnel are aware of and acknowledge their information security responsibilities.

Customized Approach Objective

Personnel understand their role in protecting the entity's cardholder data.

Defined Approach Testing Procedures

12.1.3.a Examine the information security policy to verify that they clearly define information security roles and responsibilities for all personnel.

12.1.3.b Interview personnel in various roles to verify they understand their information security responsibilities.

12.1.3.c Examine documented evidence to verify personnel acknowledge their information security responsibilities.

Purpose

Without clearly defined security roles and responsibilities assigned, there could be misuse of the organization's information assets or inconsistent interaction with information security personnel, leading to insecure implementation of technologies or use of outdated or insecure technologies.

Good Practice

Clearly defined roles and responsibilities help ensure that information security activities are performed by the appropriate personnel and that accountability is maintained.

Consider implementing a process to periodically verify that personnel understand their information security responsibilities, such as through security awareness training, assessments, or during performance reviews.

Ensure that information security responsibilities are documented and communicated to all personnel, including new hires, contractors, and third-party service providers with access to the organization's systems or data.

Definitions

Information security roles and responsibilities define who is accountable for specific security functions and activities within the organization. This includes responsibilities for implementing security controls, monitoring security events, responding to security incidents, and maintaining security policies and procedures.

Further Information

Refer to industry standards and the PCI DSS standard for further information on requirement 12.1.3.