What it asks for. Requirement 12 of PCI DSS v4.0 covers governance of information security. It includes an overall security policy, acceptable use policies, targeted risk analyses, managing PCI DSS scope, a security awareness programme, personnel screening, management of third party service providers and an incident response plan.
In practice. Organisations maintain approved and reviewed policies, assign responsibility for PCI DSS compliance, confirm scope at least annually and run an awareness programme that covers threats such as phishing and social engineering. Service providers are listed, with written agreements and monitoring of their compliance status. Evidence includes policies, training records, risk analyses, scope documentation, provider inventories and tested incident response plans.
Common gaps. Targeted risk analyses introduced in v4.0 are often thin or missing. Third party service provider responsibilities are frequently unclear.