12.4.2—Additional requirement for service providers only: Reviews are performed at least once every three months to confirm personnel are performing their tasks in accordance with all security policies and all operational procedures.
>Requirement Description
Additional requirement for service providers only: Reviews are performed at least once every three months to confirm personnel are performing their tasks in accordance with all security policies and all operational procedures. Reviews are performed by personnel other than those responsible for performing the given task and include, but not limited to, the following tasks: Daily log reviews. Configuration reviews for network security controls. Applying configuration standards to new systems. Responding to security alerts. Change-management processes. Applicability Notes This requirement applies only when the entity being assessed is a service provider.
>Cross-Framework Mappings
Ask AI
Configure your API key to use AI features.