Risk
PCIComplianceHubLast updated
The potential for loss or harm when a threat exploits a vulnerability, judged by how likely that is and how serious the result would be. PCI DSS v4.0.1 has no general risk assessment requirement; it uses risk to rank vulnerabilities and set patch timing, and asks for targeted risk analyses where a control's frequency is left to the entity or where the Customized Approach is used.
Applies to. PCI DSS v4.0.1 uses risk in three concrete ways. Vulnerabilities get a risk ranking that sets patch timing: critical ones within one month, the rest at a pace the entity sets from its own assessment of the risk (6.3.1, 6.3.3). Where an insecure service, protocol or port is kept, or a system is judged not at risk from malware, the entity documents why and what reduces the risk (1.2.6, 2.2.5, 5.2.3), and a targeted risk analysis performed under 12.3.1 sets how often such periodic evaluations run (5.2.3.1).
Limits. v4.0.1 has no requirement for an organisation-wide risk assessment. The targeted risk analysis in 12.3.1 is scoped to the specific requirements that let the entity choose a frequency, and 12.3.2 to requirements met with the Customized Approach.
Related. Risk Assessment, Targeted Risk Analysis (TRA), Risk Ranking, Vulnerability, Risk Management
Sources. PCI DSS v4.0.1 (June 2024)