Requirement 12 - Support Information Security with Organizational Policies and Programs

Requirement 12 mandates that an organization establish and maintain comprehensive information-security policies and programs covering all PCI DSS obligations, including risk assessment, policy awareness, and incident-response procedures, with documented policies reviewed and updated at least annually.