Free guide · PCI DSS v4.0.1

PCI DSS Requirement 12.10.1 — Incident response plan

Requirement 12.10.1 requires an incident response plan that exists and is ready to be activated the moment a security incident is suspected or confirmed. It must set out roles and communication paths — including notification of payment brands and acquirers — containment and mitigation procedures, business recovery, data backup, legal reporting analysis and coverage of all critical system components.Timing: Applies in PCI DSS v4.0.1 and is assessed at every annual assessment.

Find your SAQ All guides

Who it applies to

Every entity assessed against PCI DSS, at any validation level

All SAQ types that include Requirement 12

What Requirement 12.10.1 asks for

Paraphrased from PCI DSS v4.0.1. Read the standard itself for the authoritative wording and testing procedures.

An incident response plan exists and is ready to be activated for a suspected or confirmed incident.

The plan defines roles, responsibilities, and communication and contact strategies, including notification of payment brands and acquirers at minimum.

It contains response procedures with containment and mitigation activities for different incident types.

It covers business recovery and continuity, data backup processes and analysis of legal reporting requirements.

It covers responses for all critical system components and references the payment brands' own incident procedures.

Evidence an assessor expects

The current incident response plan with a review or approval date

The contact list, including acquirer and payment brand escalation details

Records of the annual test of the plan required by 12.10.2

Post-incident reports or tabletop exercise notes showing the plan was used

Common mistakes

A generic IT incident plan with no payment brand or acquirer notification path.

A plan that was written once and never tested or updated after staff changes.

No defined criteria for what counts as a suspected account-data compromise.

Not sure whether Requirement 12.10.1 is in your scope?

Which requirements you must answer depends on the SAQ that applies to your environment. The free SAQ selector walks the official PCI SSC decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Paraphrased from PCI DSS v4.0.1 (PCI Security Standards Council). Independent summary; not endorsed by PCI SSC. Refer to the PCI SSC Document Library for the authoritative standard.