Which PCI DSS requirement focuses on implementing an incident response plan to respond to a system breach?

Which PCI DSS requirement focuses on implementing an incident response plan to respond to a system breach?

• A. Requirement 12.8.
• B. Requirement 12.9.
• C. Requirement 12.10.
• D. Requirement 12.11.

Answer: (C)

Incident response planning is addressed by PCI DSS as part of the 12-series controls. It requires organizations to develop, implement, and maintain an incident response plan to respond to system breaches. This plan isn’t just a document; it defines who does what during an incident, how to report and communicate with internal stakeholders and external parties, how to preserve evidence for forensics, and how to contain, eradicate, and recover from the breach. It also requires regular testing and updates so the plan remains effective as threats evolve. The other options relate to other governance and security activities, such as policy development, risk assessment, or vendor management, but they don’t specifically mandate an incident response plan for breaches.

Incident response planning is addressed by PCI DSS as part of the 12-series controls. It requires organizations to develop, implement, and maintain an incident response plan to respond to system breaches. This plan isn’t just a document; it defines who does what during an incident, how to report and communicate with internal stakeholders and external parties, how to preserve evidence for forensics, and how to contain, eradicate, and recover from the breach. It also requires regular testing and updates so the plan remains effective as threats evolve. The other options relate to other governance and security activities, such as policy development, risk assessment, or vendor management, but they don’t specifically mandate an incident response plan for breaches.