PCI DSS 12.1.2: Annual Information Security Policy Review
PCI DSS 12.1.2 requires organizations to review their information security policy at least annually and update it when environmental changes occur. This foundational control ensures your security policies remain effective and aligned with current business operations, regulatory requirements, and emerging threats.
What this means
This control mandates that your organization conduct a formal review of its information security policy at minimum once every 12 months. Beyond the annual cycle, you must also update the policy whenever significant changes occur in your environment—such as new business processes, technology implementations, regulatory changes, or identified security gaps. The goal is to keep your security posture documented, current, and reflective of your actual risk landscape.
How to comply
- 1.Schedule a formal annual policy review meeting with security leadership, IT management, and relevant business stakeholders
- 2.Assess your current information security policy against PCI DSS requirements and industry best practices
- 3.Identify any gaps between documented policy and actual security practices in your environment
- 4.Document all environmental changes from the past year that may impact security controls or policies
- 5.Update policy sections to address new threats, technologies, regulatory requirements, or business changes
- 6.Obtain written approval and sign-off from management on the reviewed or updated policy
- 7.Communicate policy changes to all relevant personnel and provide training as needed
- 8.Maintain dated documentation of each review, including what was reviewed and what changes were made
Evidence auditors look for
- Dated policy review meeting minutes or sign-off documents from the past 12 months
- Version-controlled information security policy documents with timestamps and change tracking
- Written evidence of management approval for annual policy reviews
- Change logs documenting policy updates made in response to environmental changes
- Training records showing personnel notified of policy updates
- Risk assessment or environmental analysis documents that triggered mid-year policy updates
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates policy review workflows and tracks mandatory review dates, sending automated reminders to ensure your team never misses the annual PCI DSS 12.1.2 deadline while maintaining audit-ready documentation of all policy reviews.
See how GRCWatch handles this control automatically
Start free trial