PCI DSS 4.0
Req 12: Information Security Policies

PCI DSS 4.0 12.10.5: 12.10.5 Plan covers alerts from security monitoring systems

The incident response plan must include monitoring of, and response to, alerts from security monitoring systems, covering at least: IDS and IPS (intrusion detection and prevention); network security controls; mechanisms detecting changes to critical files; the mechanism that detects changes and tampering on payment pages; and detection of unauthorised wireless access points. Applicability: the future-dated status applies only to the payment-page tampering bullet. Objective under the customized approach: alerts from monitoring and detection technologies are handled in a structured, repeatable way. Future-dated (payment-page bullet only): treated as a best practice up to 31 March 2025 and mandatory since then.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 91 controls across 25 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 14 controls

  • AC-2(12) Account Monitoring for Atypical Usage
  • AU-6 Audit Record Review, Analysis, and Reporting
  • CA-7 Continuous Monitoring
  • IR-1 Policy and Procedures
  • IR-2 Incident Response Training
  • IR-4 Incident Handling
  • IR-5 Incident Monitoring
  • IR-7 Incident Response Assistance
  • IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support (IR-7(1))
  • IR-8 Incident Response Plan
  • SI-4 System Monitoring
  • SI-4(5) System-Generated Alerts
  • SI-5 Security Alerts, Advisories, and Directives
  • SI-7(7) Integration of Detection and Response

FedRAMP Moderate · 14 controls

  • AC-2(12) Account Monitoring for Atypical Usage
  • AU-6 Audit Record Review, Analysis, and Reporting
  • CA-7 Continuous Monitoring
  • IR-1 Policy and Procedures
  • IR-2 Incident Response Training
  • IR-4 Incident Handling
  • IR-5 Incident Monitoring
  • IR-7 Incident Response Assistance
  • IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support (IR-7(1))
  • IR-8 Incident Response Plan
  • SI-4 System Monitoring
  • SI-4(5) System-Generated Alerts
  • SI-5 Security Alerts, Advisories, and Directives
  • SI-7(7) Integration of Detection and Response

NIST SP 800-53 Rev 5 · 8 controls

CIS Controls v8 · 7 controls

  • CIS-10.1 Deploy and Maintain Anti-Malware Software
  • CIS-13.1 Centralize Security Event Alerting
  • CIS-13.3 Deploy a Network Intrusion Detection Solution
  • CIS-17.3 Establish and Maintain an Enterprise Process for Reporting Incidents
  • CIS-17.4 Establish and Maintain an Incident Response Process
  • CIS-17.6 Define Mechanisms for Communicating During Incident Response
  • CIS-17.9 Establish and Maintain Security Incident Thresholds

ISO 27002:2022 · 6 controls

  • 5.24 Information security incident management planning and preparation
  • 5.25 Assessment and decision on information security events
  • 5.26 Response to information security incidents
  • 6.8 Information security event reporting
  • 8.16 Monitoring activities
  • 8.7 Protection against malware

NIST Cybersecurity Framework 2.0 · 6 controls

  • NIST-CSF-DE.AE-06 Information on adverse events is provided to authorized staff and tools
  • NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
  • NIST-CSF-DE.CM-01 Networks and network services are monitored to find potentially adverse events
  • NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
  • NIST-CSF-RS.MA-02 Incident reports are triaged and validated
  • NIST-CSF-RS.MA-03 Incidents are categorized and prioritized

ISO 27001:2022 · 5 controls

  • 5.24 Information security incident management planning and preparation 
  • 5.25 Assessment and decision on information security events
  • 5.26 Response to information security incidents
  • 8.16 Monitoring activities
  • 8.7 Protection against malware

SOC 2 · 4 controls

  • SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
  • SOC2-CC7.2 CC7.2 Monitoring system components for anomalies
  • SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents
  • SOC2-CC7.4 CC7.4 Responding to security incidents

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

APRA CPS 234 · 2 controls

  • CPS234-30 Detection and Response Mechanisms
  • CPS234-P25 Response Plan Content and Escalation Mechanisms

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-28 Continuous incident detection and response (Excellent)
  • ASD37-32 Network-based IDS/IPS (Limited)

AWS Well-Architected Security Pillar · 2 controls

  • SEC04-BP03 Correlate and enrich security alerts
  • SEC10-BP04 Develop and test security incident response playbooks

Azure Security Benchmark · 2 controls

  • ASBv3-IR-2 Preparation - setup incident notification
  • ASBv3-IR-3 Detection and analysis - create incidents based on high-quality alerts

C5 (Germany) · 2 controls

  • C5-OPS-16 Logging and Monitoring - Configuration
  • C5-SIM-02 Processing of security incidents

CMMC 2.0 · 2 controls

ISO 27701:2019 · 2 controls

  • 6.13 Information security incident management
  • 6.13.1 Management of information security incidents and improvements

NIST SP 800-171 Rev 3 · 2 controls

  • 03.06.01 Incident Handling
  • 03.06.02 Incident Monitoring, Reporting, and Response Assistance

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-40 Define a Security Incident Management Procedure

Australia Consumer Data Right - Banking (CDR) · 1 control

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-16 Security Incident Response Plan and Testing

HIPAA Security Rule · 1 control

ISO 22301:2019 · 1 control

  • 8.4.4 Business continuity plans

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-172 · 1 control

  • 3.14.2e Monitor Organizational Systems with Specialized Capabilities

NIST SP 800-66 Rev 2 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Req 12: Information Security Policies

You are reading one control. How much of PCI DSS 4.0 have you already done?

PCI DSS 4.0 12.10.5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.

If you hold ISO 27001:202249.6% covered · 141 gapsIf you hold FedRAMP Moderate49.3% covered · 142 gapsIf you hold NIST SP 800-53 Rev 547.5% covered · 147 gapsIf you hold ISO 27002:202243.2% covered · 159 gapsIf you hold CIS Controls v838.2% covered · 173 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.136.4% covered · 178 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 91 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll PCI DSS 4.0 controls