← PCI DSS 4.0.1 · Req 12 — Policies and programmes
12.10 — Incident response plan for suspected compromise of account data
Requirement
An incident response plan exists and is ready to be activated in the event of a suspected or confirmed security incident, covering roles, communication and contact strategies including notifying payment brands and acquirers, containment and mitigation, business recovery, and legal requirements; it is reviewed and tested at least once every 12 months, and it is initiated when stored PAN is found where it is not expected.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.33 | Notification of a breach to the supervisory authority | breach-notification incident-response |
| SOC 2 | CC7.4 | Incident response programme | incident-response breach-notification |
| HIPAA | 164.308(a)(6)(ii) | Response and reporting (R) | incident-response breach-notification |
| HIPAA | 164.404-410 | Breach notification to individuals, HHS and the media | breach-notification incident-response |
| NIST CSF 2.0 | RS.CO-02 | Internal and external stakeholders are notified | breach-notification incident-response |
| NDPA 2023 | s.40 | Personal data breaches: notification and breach records | breach-notification incident-response |
| GDPR | Art.34 | Communication of a breach to data subjects | breach-notification |
| SOC 2 | CC7.3 | Evaluation of security events | incident-response |