[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:pci-dss\u002Frequirement-12":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"pci-dss","requirement-12","Requirement 12.6","Requirement 12: Support Information Security with Organizational Policies and Programs",18,"PCI Security Standards Council","**What it asks for.** Requirement 12 of PCI DSS v4.0 covers governance of information security. It includes an overall security policy, acceptable use policies, targeted risk analyses, managing PCI DSS scope, a security awareness programme, personnel screening, management of third party service providers and an incident response plan.\n\n**In practice.** Organisations maintain approved and reviewed policies, assign responsibility for PCI DSS compliance, confirm scope at least annually and run an awareness programme that covers threats such as phishing and social engineering. Service providers are listed, with written agreements and monitoring of their compliance status. Evidence includes policies, training records, risk analyses, scope documentation, provider inventories and tested incident response plans.\n\n**Common gaps.** Targeted risk analyses introduced in v4.0 are often thin or missing. Third party service provider responsibilities are frequently unclear.",null,"https:\u002F\u002Fwww.pcisecuritystandards.org\u002Fstandards\u002Fpci-dss\u002F","Read about PCI DSS","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"amazon-prime-phishing-scam-harvests-credentials-and-card-data-via-fake-billing-alerts","Amazon Prime Phishing Scam Harvests Credentials and Card Data via Fake Billing Alerts","2026-09-30T12:21:12.766+00:00",{"slug":23,"title":24,"published_at":25},"traditional-credit-card-fraud-remains-a-persistent-threat","Traditional Credit Card Fraud Remains a Persistent Threat","2026-09-26T20:22:11.622+00:00",{"slug":27,"title":28,"published_at":29},"rydox-cybercrime-marketplace-operator-pleads-guilty-to-identity-theft-and-money-laundering","Rydox Cybercrime Marketplace Operator Pleads Guilty to Identity Theft and Money Laundering","2026-09-25T14:21:19.894+00:00",{"slug":31,"title":32,"published_at":33},"scattered-spider-member-pleads-guilty-social-engineering-leads-to-176m-in-fraud","Scattered Spider Member Pleads Guilty: Social Engineering Leads to $17.6M in Fraud","2026-09-18T22:20:22.702+00:00",{"slug":35,"title":36,"published_at":37},"doppelcarts-119000-fake-shops-highlight-consumer-fraud-risks","DoppelCart's 119,000 Fake Shops Highlight Consumer Fraud Risks","2026-09-08T22:21:39.896+00:00",{"slug":39,"title":40,"published_at":41},"grandoreiro-banking-trojan-returns-with-stronger-evasion-capabilities","Grandoreiro Banking Trojan Returns With Stronger Evasion Capabilities","2026-08-20T14:20:35.506+00:00",{"slug":43,"title":44,"published_at":45},"service-provider-flaw-enables-30m-bank-fraud","Service Provider Flaw Enables €30M Bank Fraud","2026-08-14T20:20:19.53+00:00",{"slug":47,"title":48,"published_at":49},"android-malware-duo-steals-card-data-and-enables-fraudulent-loans-via-nfc-relay","Android Malware Duo Steals Card Data and Enables Fraudulent Loans via NFC Relay","2026-08-13T00:20:41.041+00:00",{"slug":51,"title":52,"published_at":53},"shinyhunters-breaches-ey-via-third-party-platform-exposing-sensitive-financial-data","ShinyHunters Breaches EY via Third-Party Platform, Exposing Sensitive Financial Data","2026-07-29T08:21:28.59+00:00",{"slug":55,"title":56,"published_at":57},"fake-braintree-nuget-package-steals-payment-data-via-typosquatting","Fake Braintree NuGet Package Steals Payment Data via Typosquatting","2026-07-09T23:20:24.369+00:00",{"slug":59,"title":60,"published_at":61},"pci-dss-is-a-security-practice-not-a-paper-exercise","PCI DSS Is a Security Practice, Not a Paper Exercise","2026-06-24T02:20:27.239+00:00",{"slug":63,"title":64,"published_at":65},"cybercrime-marketplace-operator-extradited-for-phishing-kit-sales-and-mass-fraud","Cybercrime Marketplace Operator Extradited for Phishing Kit Sales and Mass Fraud","2026-06-23T15:21:41.871+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",7,{"slug":73,"name":74,"problem":75,"stories":76},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",6,{"slug":78,"name":79,"problem":80,"stories":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":83,"name":84,"problem":85,"stories":86},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",3,{"slug":88,"name":89,"problem":90,"stories":86},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",{"slug":92,"name":93,"problem":94,"stories":86},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[96,102,108,113,117,122,127,131],{"family":97,"item":98,"code":99,"title":100,"together":101},"gdpr","32","Article 32","Security of processing",11,{"family":103,"item":104,"code":105,"title":106,"together":107},"cis","14","Control 14","Security Awareness and Skills Training",10,{"family":109,"item":110,"code":111,"title":112,"together":71},"nist-800-53","at-2","AT-2","Literacy Training and Awareness",{"family":114,"item":115,"code":116,"title":116,"together":76},"itil","overview","ITIL",{"family":118,"item":119,"code":120,"title":121,"together":81},"nist-csf","pr-at","PR.AT-1","Awareness and Training",{"family":109,"item":123,"code":124,"title":125,"together":126},"ir-6","IR-6","Incident Reporting",4,{"family":103,"item":128,"code":129,"title":130,"together":126},"3","Control 3","Data Protection",{"family":97,"item":132,"code":133,"title":134,"together":126},"33","Article 33","Notification of a personal data breach to the supervisory authority"]