Which PCI DSS requirement assigns to an individual or team the information security management responsibilities?

Which PCI DSS requirement assigns to an individual or team the information security management responsibilities?

• A. Requirement 12.5.5
• B. Requirement 12.5
• C. Requirement 12.3
• D. Requirement 12.4

Answer: (B)

Assigning ownership for the information security program is what creates accountability and clear responsibility for protecting cardholder data. In PCI DSS, Requirement 12 covers the organization-wide security program, and the specific component that states an individual or team must be given responsibility for the information security program is 12.5. This ensures there is a named owner or group responsible for implementing, maintaining, and enforcing security controls, handling incidents, and keeping program practices up to date. Without that explicit assignment, security duties can drift or be neglected. The other items relate to different aspects of the security program—policy development, risk assessment, or change management—without explicitly establishing an ownership role. That’s why 12.5 is the best fit for the requirement described.

Assigning ownership for the information security program is what creates accountability and clear responsibility for protecting cardholder data. In PCI DSS, Requirement 12 covers the organization-wide security program, and the specific component that states an individual or team must be given responsibility for the information security program is 12.5. This ensures there is a named owner or group responsible for implementing, maintaining, and enforcing security controls, handling incidents, and keeping program practices up to date. Without that explicit assignment, security duties can drift or be neglected.

The other items relate to different aspects of the security program—policy development, risk assessment, or change management—without explicitly establishing an ownership role. That’s why 12.5 is the best fit for the requirement described.