PCI DSS 4.0
Req 12: Information Security Policies

PCI DSS 4.0 12.1.4: 12.1.4 Executive ownership of information security formally assigned

Accountability for information security must be formally given to a CISO (Chief Information Security Officer) or to another member of executive management who has adequate security knowledge. The guidance explains the aim is that someone senior with enough authority actively runs and champions the security program, says such knowledge can be shown through experience, education or certifications, and suggests entities consider succession for the role. Customized approach objective: a named executive is answerable for information security.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 37 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27701:2019 · 6 controls

  • 5.2.4 Information security management system
  • 5.3.1 Leadership and commitment
  • 5.3.3 Organizational roles, responsibilities and authorities
  • 5.5.1 Resources
  • 6.3 Organization of information security
  • 6.3.1 Internal organization

ISO/IEC 42001:2023 · 3 controls

  • 5.3 Roles, responsibilities and authorities
  • 7.1 Resources
  • A.3 Internal organization

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
  • NIST-CSF-GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
  • NIST-CSF-GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

APRA CPS 234 · 2 controls

  • CPS234-13 Board Responsibility for Information Security
  • CPS234-14 Definition of Information Security Roles and Responsibilities

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

FedRAMP High · 2 controls

  • PL-1 Policy and Procedures
  • PS-9 Position Descriptions (PS-9)

FedRAMP Moderate · 2 controls

  • PL-1 Policy and Procedures
  • PS-9 Position Descriptions (PS-9)

ISO 22301:2019 · 2 controls

  • 5.3 Roles, responsibilities and authorities
  • 7.1 Resources

NIST SP 800-53 Rev 5 · 2 controls

  • NIST800-PM-2 PM-2 Information Security Program Leadership Role
  • SP800-53-PM Program Management Family

PCI 3DS Core Security Standard · 2 controls

  • P1-1.1.4 P1-1.1.4 Management approval of the security policy
  • P2-2.1.2 P2-2.1.2 Security responsibility and accountability formally assigned

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-39 Designate an Information System Security Officer and Make the Role Known

Azure Security Benchmark · 1 control

  • GS-1 Align organization roles, responsibilities and accountabilities

C5 (Germany) · 1 control

  • C5-OIS-01 Information Security Management System (ISMS)

HIPAA Security Rule · 1 control

ISO 27001:2022 · 1 control

  • 5.2 Information security roles and responsibilities

ISO 27002:2022 · 1 control

  • 5.2 Information security roles and responsibilities

NIS2 Directive · 1 control

  • Art.20.1 Management body approves the cybersecurity risk-management measures and oversees their implementation

NIST SP 800-161 Rev 1 · 1 control

  • 161R1-PM-2 Information Security Program Leadership Role

NIST SP 800-181 · 1 control

NIST SP 800-66 Rev 2 · 1 control

SOC 2 · 1 control

  • SOC2-CC1.3 CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Req 12: Information Security Policies

You are reading one control. How much of PCI DSS 4.0 have you already done?

PCI DSS 4.0 12.1.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.

If you hold ISO 27001:202249.6% covered · 141 gapsIf you hold FedRAMP Moderate49.3% covered · 142 gapsIf you hold NIST SP 800-53 Rev 547.5% covered · 147 gapsIf you hold ISO 27002:202243.2% covered · 159 gapsIf you hold CIS Controls v838.2% covered · 173 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.136.4% covered · 178 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 37 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll PCI DSS 4.0 controls