Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Item 12.1.2 of PCI DSS requires that the company's security policy:

12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment.

NIST has published a Guide for Conducting Risk Assessments, which is pretty detailed and could be used as our process. In order to satisfy that requirement, is it enough to just point to the NIST Guide or should the company develop its own customized process (albeit based on the Guide)?

share|improve this question

At a glance, the NIST guide you've linked to describes the goals and backgrounds that would be conducted in an assessment, but there's nothing there you can point to and say, "We followed these steps." It doesn't provide a quantifiable, verifiable process that an auditor can confirm.

You'll have to find another resource or develop your own.

share|improve this answer
It's our first PCI assessment, so we haven't yet gone through the annual process yet. But even if we had, couldn't we just show the resulting documents? I mean, the list of threat sources, vulnerabilities etc? – Otavio Macedo Jan 31 '13 at 19:34
A good auditor will usually assist you with writing up the policy document to reflect what you've been doing. – Jeff Ferland Jan 31 '13 at 19:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.