Which sub-requirement requires establishing, documenting, and distributing security policies and procedures?

Which sub-requirement requires establishing, documenting, and distributing security policies and procedures?

• A. Requirement 12.5.3
• B. Requirement 12.5.1
• C. Requirement 12.4
• D. Requirement 12.5.4

Answer: (B)

Establishing, publishing, maintaining, and disseminating a security policy creates the governance framework that guides all information security actions for everyone in the organization. This sub-requirement is specifically about creating the formal policy and making sure it is documented and accessible to all personnel, so they know the rules for protecting cardholder data. By requiring the policy to be published and distributed, it ensures awareness, accountability, and consistent practice across the organization. Other sub-requirements in this area address updating the policy, disseminating it to staff, or handling specific procedures or security areas, but they do not themselves establish and distribute the policy itself.

Establishing, publishing, maintaining, and disseminating a security policy creates the governance framework that guides all information security actions for everyone in the organization. This sub-requirement is specifically about creating the formal policy and making sure it is documented and accessible to all personnel, so they know the rules for protecting cardholder data. By requiring the policy to be published and distributed, it ensures awareness, accountability, and consistent practice across the organization.

Other sub-requirements in this area address updating the policy, disseminating it to staff, or handling specific procedures or security areas, but they do not themselves establish and distribute the policy itself.