Item 12.1.2 of PCI DSS requires that the company's security policy:

12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment.

NIST has published a Guide for Conducting Risk Assessments, which is pretty detailed and could be used as our process. In order to satisfy that requirement, is it enough to just point to the NIST Guide or should the company develop its own customized process (albeit based on the Guide)?

1 Answer 1


At a glance, the NIST guide you've linked to describes the goals and backgrounds that would be conducted in an assessment, but there's nothing there you can point to and say, "We followed these steps." It doesn't provide a quantifiable, verifiable process that an auditor can confirm.

You'll have to find another resource or develop your own.

  • It's our first PCI assessment, so we haven't yet gone through the annual process yet. But even if we had, couldn't we just show the resulting documents? I mean, the list of threat sources, vulnerabilities etc? Jan 31, 2013 at 19:34
  • A good auditor will usually assist you with writing up the policy document to reflect what you've been doing.
    – Jeff Ferland
    Jan 31, 2013 at 19:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .