PCI DSS Requirement 12 Incident Response Planning

Requirement 12.10 requires an incident response plan that is tested at least annually. Audit findings often involve plans that exist but fail in practice, rather than plans that are missing. Saving a documented plan in a shared drive is only the starting point. QSAs test whether the plan works: whether people understand their roles, evidence preservation has been practiced, and the plan addresses a suspected cardholder data breach rather than only generic security incidents.

This piece explains what Requirement 12.10 demands, which records QSAs review, and how to run an incident response program that meets both the wording and operational purpose of the requirement.

Requirement 12.10 Basics

The main 12.10 obligations in DSS 4.0 are:

12.10.1 requires a documented incident response plan, used immediately when a system compromise is suspected. At minimum, it must cover roles, responsibilities, communication and reporting channels; procedures for all critical system components; data backup and recovery; legal reporting requirements, including obligations under many card brand rules and state laws to notify affected parties; payment card brand referrals and responses; and a PCI forensic investigator (PFI) referral process.

12.10.2 requires the plan to be reviewed and tested at least every 12 months. Testing is more than reading it in a team meeting. QSAs seek evidence of a tabletop exercise or simulation using realistic scenarios, with results reviewed and the plan updated for what the exercise found.

12.10.3 requires named personnel to respond to a suspected compromise and requires their availability 24 hours per day, 7 days per week.

12.10.5 requires changes to the incident response plan after lessons are learned from a security incident or plan test.

DSS 4.0 added 12.10.7. When cardholder data appears in an unexpected location, such as PAN discovery finding it on a system not known to handle card data, the incident response plan must be engaged immediately. This links incident response with PAN discovery and data minimization.

What QSAs Test

In practice, QSAs consistently assess three evidence categories as satisfactory or inadequate.

Defined roles and contact chains for a suspected cardholder data breach. Generic plans often name titles, such as "the CISO will be notified." A PCI-compliant plan needs named people and contact details, or at least a reachable 24/7 contact point, plus escalation paths and clear ownership for communications with card brands and potentially affected merchants or customers. Visa and Mastercard rules set specific, time-bound notification duties. The plan must acknowledge them and assign responsibility. "Legal will handle notifications" is not specific enough.

A process for preserving forensic evidence. When a breach is suspected, preserve evidence in a form a PCI forensic investigator can use. Do not reimage the compromised system before the investigator arrives, rotate logs that may record the attack, or shut systems down when isolation is possible. State these steps directly. Responders often want to fix the issue quickly, but that is the wrong instinct during a forensic investigation. Specify who authorizes isolation or remediation, how logs are preserved, the first call to engage a PFI, and who decides whether to preserve or restore.

Evidence that the plan was exercised, not merely drafted. This is a common assessment gap. Meeting notes, the scenario, participant attendance, findings, and resulting plan updates usually document a tabletop exercise. A polished plan without exercise evidence can be flagged: it shows intent, while 12.10.2 requires operational proof.

Tabletop Exercises That Create Evidence

A 12.10 tabletop exercise should not test whether the team can solve a simulated breach. It should confirm that decision points work in realistic conditions and create evidence that testing occurred.

A useful PCI scenario: a QSA from a third-party assessment firm contacts your team because a card-present terminal at a merchant location you process for appears in a batch of compromised cards traced by a card brand's fraud analytics. You have 24 hours to provide an initial report on potentially involved systems. Start there and walk through the plan: who is called, who decides on isolation, who notifies the card brand, who engages the PFI, and which logs and systems are preserved.

Record the date, participants' names and roles, scenario text, a time-stamped walkthrough of each decision, plan gaps or ambiguities, and the specific resulting changes. This package is your 12.10.2 evidence.

Keeping the Plan Current

A frequent audit problem is a test conducted 14 months ago, outside the 12-month window, or an updated plan that was never formally approved. A calendar reminder and simple review sign-off can prevent both.

Review the plan annually for accuracy. Confirm that named contacts and phone numbers match current personnel. Check whether CDE changes, including new systems, payment channels, or third-party processors, appear in the plan. Add lessons from near-miss incidents during the past 12 months. Record the review and changes in a named plan version with a dated approval signature.

We should be clear about what monitoring tools can and cannot do for incident response readiness. Continuous CDE monitoring can detect triggers such as unexpected PAN-like data in logs, anomalous authentication events, or unexpected CDE configuration changes. Faster detection shortens the time between a breach and response. The plan, roles, contact chains, forensic procedures, tabletop exercise, and records still require people. Monitoring supplies the signal; the plan sets the next steps.

Requirement 12.10 QSA Evidence

When QSA fieldwork begins for Requirement 12.10, prepare the current incident response plan with its version date; the latest annual test or tabletop records, including scenario and participants; evidence of updates after identified gaps; the 24/7 response team contact list, using names or verified contact points rather than titles alone; and records showing how the plan covers card brand notifications and PFI engagement.

For any security incident in the past 12 months that activated the plan, show how it was followed and what response records were created. A well-managed real incident is stronger operational evidence than a tabletop, and QSAs will ask about it if they know it occurred.