Which PCI DSS requirement requires maintaining a policy that addresses information security for all personnel?

Which PCI DSS requirement requires maintaining a policy that addresses information security for all personnel?

• A. Requirement 6
• B. Requirement 12
• C. Requirement 9
• D. Requirement 3

Answer: (B)

The key idea here is that every organization handling cardholder data must have a formal security policy that applies to all personnel. This requirement ensures that everyone—employees, contractors, and vendors—knows their security responsibilities, receives appropriate awareness training, and follows consistent security practices. The policy must be documented, communicated to all staff, and reviewed regularly, with ongoing training to keep security awareness current. This broad, organization-wide policy is what links people’s behavior to the protection of cardholder data, not just technical controls or specific physical protections. The other areas focus on different areas of security: one centers on building secure systems and applications, another on protecting physical access to the data environment, and another on protecting stored cardholder data. While all of these are important, they do not address the requirement to maintain a policy that covers information security for every person with access to cardholder data.

The key idea here is that every organization handling cardholder data must have a formal security policy that applies to all personnel. This requirement ensures that everyone—employees, contractors, and vendors—knows their security responsibilities, receives appropriate awareness training, and follows consistent security practices. The policy must be documented, communicated to all staff, and reviewed regularly, with ongoing training to keep security awareness current. This broad, organization-wide policy is what links people’s behavior to the protection of cardholder data, not just technical controls or specific physical protections.

The other areas focus on different areas of security: one centers on building secure systems and applications, another on protecting physical access to the data environment, and another on protecting stored cardholder data. While all of these are important, they do not address the requirement to maintain a policy that covers information security for every person with access to cardholder data.