A documented plan for detecting, containing, eradicating and recovering from a security incident, covering roles and responsibilities, communication paths, escalation, evidence handling and return to normal operation. PCI DSS Requirement 12.10 sets specific expectations: designated personnel must be available 24 hours a day, seven days a week to respond to suspected or confirmed incidents; the plan must be reviewed and tested at least once every 12 months; and it must cover notification of the payment brands and acquirers, analysis of the legal requirements for reporting compromises, and reference to or inclusion of the payment brands' own incident response procedures. A plan that has never been exercised does not satisfy the requirement.
Applies to. Applies to any entity assessed against PCI DSS v4.0.1; 12.10.1 requires the plan to exist, to be ready to activate for a suspected or confirmed security incident, and to cover all critical system components. Its required content is listed there: roles, responsibilities and contact strategies including notification of payment brands and acquirers; containment and mitigation procedures for different incident types; business recovery and continuity; data backup; analysis of legal reporting obligations; and the payment brands' incident response procedures. Around it sit 12.10.3 (named personnel available 24/7), 12.10.2 (annual review and a test of every 12.10.1 element), 12.10.5 (monitoring and responding to alerts from IDS/IPS, network security controls, change-detection on critical files, the payment page tamper-detection mechanism and rogue wireless detection) and 12.10.6 (updating the plan from lessons learned and industry developments).
Example. A subscription-box merchant's plan names the head of engineering as incident lead, lists out-of-hours numbers for the on-call engineer and the acquirer's fraud desk, and holds a one-page runbook for each of three scenarios: a compromised administrator account, malware on a server in the card segment, and a tamper alert from the payment page monitor. Each October the team walks one scenario through end to end, notes what slowed them down, and updates the plan.
Limits. A plan is not a policy statement: 12.10.1.b has the assessor check records of past incidents and alerts against the plan to confirm it was followed, and 12.10.2 requires a test covering every 12.10.1 element, so a document with no exercise record and no incident record has little to show. It is not the business continuity plan: business recovery and continuity procedures are one element inside the incident response plan, not a substitute for it. 12.10.1 does not itself name a PCI Forensic Investigator; what it requires is that the plan reference or include the payment brands' own incident response procedures. And the 24/7 obligation in 12.10.3 is about designated people, not a monitoring tool: an alert that fires at three in the morning with nobody named to answer it fails the requirement.