12.1 Information security policy established and maintained
What the standard requires
The PCI SSC publishes the standard at no cost under a click-through licence that does not permit redistribution, so the requirement text cannot be embedded here.
The security standard for organizations that store, process, or transmit payment card data, structured as 12 principal requirements covering network security, cardholder data protection, vulnerability management, access control, monitoring, and policy. Each requirement expands into testing procedures used in a Report on Compliance.
Download free from the PCI SSC Document Library →If your organisation holds a licence for PCI DSS v4.0.1, CMDash can load the real text against every control through the framework import, where it is stamped as tenant-provided.
Maps to 1 control in 1 other framework
| Framework | Control |
|---|---|
| NIST Cybersecurity Framework (1.1, legacy) | ID.GV-1 Organizational cybersecurity policy established |
Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.