A3.3.1.1 Failures of any critical security control systems are responded to promptly

Defined Approach Requirements

A3.3.1.1 Failures of any critical security control systems are responded to promptly. Processes for responding to failures in security control systems include:

• Restoring security functions.
• Identifying and documenting the duration (date and time from start to end) of the security failure.
• Identifying and documenting the cause(s) of failure, including root cause, and documenting remediation required to address the root cause.
• Identifying and addressing any security issues that arose during the failure.
• Determining whether further actions are required as a result of the security failure.
• Implementing controls to prevent the cause of failure from reoccurring.
• Resuming monitoring of security controls.

PCI DSS Reference: Requirements 1-12

Customized Approach Objective

This requirement is not eligible for the customized approach.

Defined Approach Testing Procedures

A3.3.1.1.a Examine documented policies and procedures and interview personnel to verify processes are defined and implemented to respond promptly to a security control failure in accordance with all elements specified in this requirement.

A3.3.1.1.b Examine records to verify that security control failures are documented to include:

• Identification of cause(s) of the failure, including root cause.
• Duration (date and time start and end) of the security failure.
• Details of the remediation required to address the root cause.

Purpose

If alerts from failures of critical security control systems are not responded to quickly and effectively, attackers may use this time to insert malicious software, gain control of a system, or steal data from the entity's environment.

Good Practice

Documented evidence (for example, records within a problem management system) should support processes and procedures in place that respond to security failures. In addition, personnel should be aware of their responsibilities in the event of a failure. Actions and responses to the failure should be captured in the documented evidence.