PCI DSS 12.10.6: Evolving Your Incident Response Plan
Your incident response plan isn't static—it must evolve as threats change and your organization learns from security events. PCI DSS 12.10.6 requires you to regularly update your IR plan based on lessons learned and industry developments. GRCWatch helps you capture, document, and implement those learnings systematically.
What this means
Control 12.10.6 mandates that organizations continuously improve their incident response capabilities by incorporating insights from past incidents, near-misses, and emerging threat intelligence. This means documenting what worked and what didn't during response activities, staying informed about industry security trends, and formally updating your IR plan to reflect these learnings. The goal is to progressively strengthen your response capabilities and reduce incident impact over time.
How to comply
- 1.Establish a post-incident review process that documents lessons learned after each security event or IR exercise
- 2.Capture specific findings about plan effectiveness, gaps, and response delays during incident reviews
- 3.Monitor industry threat intelligence, regulatory updates, and peer incident reports quarterly
- 4.Prioritize plan updates based on relevance to your environment and threat landscape
- 5.Formally approve and distribute updated IR plan versions to all relevant personnel
- 6.Test updated procedures through tabletop exercises or simulations before full deployment
- 7.Maintain version history of your IR plan with dates and reasons for each update
Evidence auditors look for
- Post-incident review meeting notes with identified process gaps and improvement actions
- Updated IR plan versions with change logs showing dates, updates, and approval signatures
- Records of industry threat briefings, advisories, or conference learnings incorporated into the plan
- Tabletop exercise results demonstrating testing of newly updated procedures
- Training sign-off sheets confirming staff awareness of revised IR procedures
- Quarterly IR plan review meeting minutes with documented lessons learned discussions
- Incident response retrospectives tied to specific plan improvements implemented
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates post-incident lesson capture and connects findings directly to IR plan updates, eliminating manual tracking and ensuring lessons learned from each incident systematically improve your documented procedures.
See how GRCWatch handles this control automatically
Start free trial