c12.2 Establish security and acceptable use policies
Establish, publish, and maintain a comprehensive information security policy and acceptable use policies for technologies, reviewed at least annually.
Requirement 12
Support Information Security with Organizational Policies and Programs
PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.
12.1 A comprehensive information security policy is established, published, maintained, and disseminated
- 12.1.1 Information security policy established, published, maintained Your responsibility
- 12.1.2 Information security policy reviewed at least annually Your responsibility
- 12.1.3 Security policy defines roles and responsibilities Your responsibility
- 12.1.4 Responsibility for information security formally assigned to a CISO Your responsibility
12.2 Acceptable use policies for end-user technologies are defined and implemented
- 12.2.1 Acceptable use policies for end-user technologies defined Your responsibility
How to implement on AWS
Document the security and acceptable use policies and publish them to personnel. Codify the technical controls that back the policy as guardrails (SCPs, Config rules) so the policy intent is technically enforced. Review and update the policies at least every 12 months.
Practical implementation
How this control is implemented in each reference architecture:
Write and publish the security and acceptable-use policies, and make their intent technically enforceable rather than aspirational.
- Document the information security policy and acceptable-use policies and publish them to personnel.
- Back the policy with technical guardrails (Config rules, IAM policies) so the intent is enforced, not just written.Account-wide
AWS Config 
IAM - Review and update the policies at least every 12 months.
How to validate: The policies exist, are published, reviewed within 12 months, and are reflected in enforcing Config/IAM controls.
Avoid: A policy PDF with no technical backing. Encode the intent as guardrails so it is actually enforced.
Codify policy intent as organization-wide guardrails so the written policy is technically enforceable in every account.
- Publish the org-level security and acceptable-use policies once for all personnel.
- Enforce the policy with SCPs on the PCI OU plus Config conformance packs org-wide.PCI OU (guardrail)
AWS Organizations AWS Config - Review and update policies and guardrails at least annually.
How to validate: SCPs and conformance packs implement the written policy across all accounts, and the policy review is current.
Avoid: Policies that each account interprets differently. Encode them as org-wide SCPs/conformance packs for uniform enforcement.
PCI validation
Testing procedures
- Examine the information security policy and interview personnel to verify it is established, published, maintained, and reviewed at least every 12 months (12.1.1, 12.1.2).
- Examine the acceptable use policies for end-user technologies and interview personnel to verify they are documented and implemented per the requirement (12.2.1).
Evidence in AWS
- Security and acceptable use policy documents with annual review history.
- Technical guardrails (SCPs/Config rules) that reflect the policy.
- Evidence of communicating the policies to personnel.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 12.1 — The strategic objectives and principles of information security are defined, adopted, and known to all personnel.
- 12.2 — The use of end-user technologies is defined and managed to ensure authorized usage.
AWS services
AWS Organizations AWS Config Learning resources
References
- PCI DSS v4.0.1 Requirements 12.1, 12.2