Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Item 12.1.2 of PCI DSS requires that the company's security policy:

12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment.

NIST has published a Guide for Conducting Risk Assessments, which is pretty detailed and could be used as our process. In order to satisfy that requirement, is it enough to just point to the NIST Guide or should the company develop its own customized process (albeit based on the Guide)?

share|improve this question

1 Answer

up vote 2 down vote

At a glance, the NIST guide you've linked to describes the goals and backgrounds that would be conducted in an assessment, but there's nothing there you can point to and say, "We followed these steps." It doesn't provide a quantifiable, verifiable process that an auditor can confirm.

You'll have to find another resource or develop your own.

share|improve this answer
It's our first PCI assessment, so we haven't yet gone through the annual process yet. But even if we had, couldn't we just show the resulting documents? I mean, the list of threat sources, vulnerabilities etc? – Otavio Macedo Jan 31 at 19:34
A good auditor will usually assist you with writing up the policy document to reflect what you've been doing. – Jeff Ferland♦ Jan 31 at 19:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.