💼 12.2 Implement a risk-assessment process.

• Contextual name: 💼 12.2 Implement a risk-assessment process.

• ID: /frameworks/pci-dss-v3.2.1/12/02

• Located in: 💼 12 Maintain a policy that addresses information security for all personnel.

Description

This process:

• Is performed at least annually and upon significant changes to the environment (for example, acquisition, merger, relocation, etc.),
• Identifies critical assets, threats, and vulnerabilities, and
• Results in a formal, documented analysis of risk.

Examples of risk-assessment methodologies include but are not limited to OCTAVE, ISO 27005 and NIST SP 800-30.

Similar

• Internal
  • ID: dec-c-eddb5b24

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags