For Requirement 12.2, how often is risk assessment performed and when else?

For Requirement 12.2, how often is risk assessment performed and when else?

• A. Monthly and whenever new systems are added
• B. At least annually and upon significant changes to the environment
• C. Only after a security breach
• D. Every two years

Answer: (B)

The main idea being tested is how often PCI DSS requires a risk assessment and what events trigger it. The best practice is to perform a formal risk assessment at least annually to keep the assessment current and aligned with the organization’s security posture, and to conduct another assessment whenever there are significant changes to the environment that could affect security. This avoids gaps when new systems, processes, or network configurations are introduced, or when the threat landscape shifts. Monthly risk assessments aren’t required and would be unnecessary for most environments; risk assessments are not about a fixed monthly cadence but about maintaining ongoing vigilance plus responding to meaningful changes. Waiting until after a security breach or renewing every two years would leave cardholder data exposed or outdated, which PCI DSS explicitly avoids. The trigger of significant changes ensures the risk picture reflects the actual environment, allowing appropriate controls to be updated or added.

The main idea being tested is how often PCI DSS requires a risk assessment and what events trigger it. The best practice is to perform a formal risk assessment at least annually to keep the assessment current and aligned with the organization’s security posture, and to conduct another assessment whenever there are significant changes to the environment that could affect security. This avoids gaps when new systems, processes, or network configurations are introduced, or when the threat landscape shifts.

Monthly risk assessments aren’t required and would be unnecessary for most environments; risk assessments are not about a fixed monthly cadence but about maintaining ongoing vigilance plus responding to meaningful changes. Waiting until after a security breach or renewing every two years would leave cardholder data exposed or outdated, which PCI DSS explicitly avoids. The trigger of significant changes ensures the risk picture reflects the actual environment, allowing appropriate controls to be updated or added.