PCI DSS Requirements for Incident Response Plan

The Payment Card Industry Data Security Standard (“PCI DSS”) is a contractual security standard for the protection of payment card data issued by the major payment brands (e.g. Visa, MasterCard and American Express). Compliance with PCI DSS is required by contracts governing participation in payment card systems, and applies to merchants who accept payment card transactions and other organizations that store or process payment card data.

PCI DSS requires that an organization implement an incident response plan so that the organization is prepared to respond immediately to a cardholder data security incident. PCI DSS specifies minimum requirements for the content of an incident response plan, for distribution of the plan to properly trained designated personnel, for annual testing of the plan and verification of the organization’s readiness to implement the plan, and for continuous improvement of the plan.

Read more here.