PCI DSS incident response: what Requirement 12.10 asks for
PCI DSS Requirement 12.10 asks for more than a written plan. Under v4.0.1 you need a plan ready to use, tested every year, people on call around the clock, trained responders, a process for acting on security alerts, and a procedure for card numbers found where they should not be. 1 Sequence Cyber Ltd, a PCI SSC-listed QSA company, reviews incident response plans against Requirement 12.10 as part of PCI DSS assessments.Last reviewed: 11 November 2026
The seven parts of Requirement 12.10
| Requirement | What it asks for |
|---|---|
| 12.10.1 | An incident response plan, ready to be activated for a suspected or confirmed incident. It covers roles, communication (including the payment brands), containment and recovery, backups, legal reporting, critical systems and payment-brand procedures. |
| 12.10.2 | The plan is reviewed, updated and tested at least once every 12 months. |
| 12.10.3 | Named people are available 24/7 to respond to suspected or confirmed incidents. |
| 12.10.4 | Responders are trained for their incident duties. |
| 12.10.4.1 | How often that training happens is set by a targeted risk analysis (Requirement 12.3.1). |
| 12.10.5 | The plan covers monitoring and responding to alerts from security monitoring, such as intrusion detection, file change detection and payment page tamper detection. |
| 12.10.6 | The plan is changed in light of lessons learned and industry developments. |
| 12.10.7 | Procedures start whenever stored card numbers (PAN) are found anywhere they are not expected. |
12.10.4.1 and 12.10.7 were new in v4.0 and became mandatory on 31 March 2025.
Requirement 12.10.7: card numbers found where they should not be
This is the part most often missed, because it is a discovery rather than an attack. When stored PAN turns up in a log, a file share or a test database, the procedure must decide what to do with it, check whether sensitive authentication data is stored with it, find where it came from, and fix the gap that let it get there.
What an assessor looks for
- The plan itself, with named roles and contact routes, including your acquirer and the payment brands.
- Evidence of a test in the last 12 months, such as a tabletop exercise record and the changes made afterwards.
- An on-call rota that shows 24/7 cover.
- Training records, and the targeted risk analysis that sets the training frequency.
- Alert handling procedures that match the monitoring tools you actually run.
- A written 12.10.7 procedure, and records if it has been used.
Frequently asked questions
Does PCI DSS require an incident response plan?
Yes. Requirement 12.10.1 requires one, and the rest of 12.10 requires it to be tested, staffed, trained and kept up to date.
How often must the plan be tested?
At least once every 12 months (Requirement 12.10.2).
What is new in v4.0.1?
Two parts that became mandatory on 31 March 2025: training frequency set by a targeted risk analysis (12.10.4.1), and procedures for card numbers found where they are not expected (12.10.7).