Risk Management

Applies to. PCI DSS v4.0.1 does not name risk management as a discipline and does not ask for a risk register or an organisation-wide risk assessment. What it tests is narrower: a targeted risk analysis for each requirement whose frequency the entity sets and for each requirement met with the Customized Approach, both under Requirement 12; a risk ranking of vulnerabilities that drives patch timing under Requirement 6; and an information security policy that is updated as risks to the environment change.

Limits. No risk management framework or methodology is required; the standard examines the documented analyses and rankings it names, not a programme around them.