PCI DSS template · PCI DSS v4.0
Information Security Policy
Overarching information security policy addressing all PCI DSS program requirements and security governance. Written for your company, citing the controls below.
- Sections
- 7
- Controls cited
- 6
- Formats
- PDF, Word
- Shelf
- 12 PCI DSSdocuments in all
No card needed to start.
- Cites
- Req. 12, SOC 2 CC1.1, SOC 2 CC5.1 and 3 more
- Formats
- PDF and Word
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Governance Structure
- Policy Review and Distribution
- Annual Risk Assessment
- Security Awareness Program
- Incident Response Overview
- Policy Exceptions
Controls it cites
The PCI DSS controls first, then the matching controls in other frameworks.
- Req. 12Security PoliciesPCI DSS
- SOC 2 CC1.1COSO Principle 1: Integrity & EthicsSOC 2
- SOC 2 CC5.1COSO Principle 10: Control ActivitiesSOC 2
- SOC 2 CC5.3COSO Principle 12: Policy DeploymentSOC 2
- ISO A.5.1Policies for Information SecurityISO 27001
- CSF PR.PS-1Platform SecurityNIST CSF
Recent changes
Updates from official sources that name this policy. All policy updates
15 Sep 2026 · PCI Security Standards Council
PCI SSC publishes AI security guidanceReview information security policies to consider AI systems as any other technology when scoping PCI requirements.
23 Jul 2026 · PCI Security Standards Council
PCI SSC publishes mapping of PCI DSS v4.0.1 to NIST CSF 2.0Review the information security policy to align PCI DSS controls with NIST CSF outcomes using the published mapping document.
10 Jun 2026 · PCI Security Standards Council
PCI SSC publishes guidance on compensating controls and customized approachReview the Information Security Policy to clarify the distinction between compensating controls and the customized approach and to define documentation requirements for each.
- PCI DSS8 sections
Incident Response Policy
CitesReq. 12.10 SOC 2 CC7.3 SOC 2 CC7.4 +4 +5PDF · WordCites Req. 12.10, Incident Response (PCI DSS); SOC 2 CC7.3, System Operations: Incident Response (SOC 2); SOC 2 CC7.4, System Operations: Incident Handling (SOC 2), and 4 more. - PCI DSS6 sections
Physical Security Policy
CitesReq. 9 SOC 2 CC6.4 ISO A.7.1 +3 +4PDF · WordCites Req. 9, Physical Access (PCI DSS); SOC 2 CC6.4, Logical & Physical Access: Physical Restrictions (SOC 2); ISO A.7.1, Physical Security Perimeters (ISO 27001), and 3 more. - PCI DSS6 sections
Vendor & Third-Party Management Policy
CitesReq. 12.8 SOC 2 CC9.2 ISO A.5.19 +3 +4PDF · WordCites Req. 12.8, Third-Party Service Providers (PCI DSS); SOC 2 CC9.2, Risk Mitigation: Vendor & Business Partner (SOC 2); ISO A.5.19, Information Security in Supplier Relationships (ISO 27001), and 3 more. - PCI DSS7 sections
Encryption Policy
CitesReq. 3 Req. 4 SOC 2 CC6.7 +4 +5PDF · WordCites Req. 3, Protect Stored Account Data (PCI DSS); Req. 4, Protect Data in Transit (PCI DSS); SOC 2 CC6.7, Logical & Physical Access: Transmission Security (SOC 2), and 4 more. - PCI DSS7 sections
Password & Authentication Policy
CitesReq. 8 SOC 2 CC6.1 SOC 2 CC6.2 +3 +4PDF · WordCites Req. 8, Identify Users & Authenticate (PCI DSS); SOC 2 CC6.1, Logical & Physical Access: Security Software (SOC 2); SOC 2 CC6.2, Logical & Physical Access: Credentials (SOC 2), and 3 more. - PCI DSS7 sections
Change Management Policy
CitesReq. 6 SOC 2 CC8.1 ISO A.8.32 +2 +3PDF · WordCites Req. 6, Secure Development (PCI DSS); SOC 2 CC8.1, Change Management (SOC 2); ISO A.8.32, Change Management (ISO 27001), and 2 more.
PCI DSS on its own
- Documents
- 12
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so PCI DSS + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.