PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 12 / c12.3
Foundational Security GovernanceSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c12.3 Formalize risk management (targeted risk analysis)

Perform the targeted risk analyses that v4.0.1 requires to support the frequency of certain controls and the organization's risk management.

Quick Wins
Foundational
Efficient
Optimized
Effort: Medium Impact: Medium Applies to CDE: No

Requirement 12

Support Information Security with Organizational Policies and Programs

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

12.3 Risks to the CDE are formally identified, evaluated, and managed
  • 12.3.1 Targeted risk analyses documented for flexible requirements Your responsibility
  • 12.3.2 Targeted risk analysis for customized-approach requirements Your responsibility
  • 12.3.3 Cryptographic cipher suites and protocols inventoried and reviewed Covered
  • 12.3.4 Hardware/software technologies reviewed for continued support Your responsibility

How to implement on AWS

Establish a targeted risk analysis process for the requirements that allow it. Support risk identification with the posture observed in Security Hub and AWS Config. Document the analyses, their periodicity, and the resulting decisions. Review at least every 12 months.

Practical implementation

How this control is implemented in each reference architecture:

Run the targeted risk analyses v4.0.1 requires, grounded in the real security posture you can observe.

  1. Establish a targeted risk analysis (TRA) process for each requirement that allows a risk-based frequency (12.3.1).
    Risk management process
  2. Ground the analyses in observed posture from Security Hub and AWS Config rather than guesswork.
    Account-wide detection Security Hub AWS Config
  3. Document each TRA, its periodicity, and the resulting decisions; review at least every 12 months.
    Risk documentation

How to validate: Documented TRAs exist for the eligible requirements, reference posture inputs, and show review within 12 months.

Avoid: Choosing control frequencies arbitrarily. v4.0.1 wants a documented, risk-based analysis behind each customizable frequency.

Single-account, 3-tier →

Feed the risk analyses with org-wide posture so decisions reflect the state of all CDE accounts, not just one.

  1. Aggregate posture from the Security Hub / Config aggregators across the PCI OU as TRA inputs.
    Security tooling account Security Hub AWS Config AWS Organizations
  2. Run TRAs once at the org level where the risk is common to all CDE accounts.
    Org risk management
  3. Document decisions and review at least annually.
    Org risk documentation

How to validate: TRAs reference org-wide posture and cover all CDE accounts, with documented decisions reviewed within 12 months.

Avoid: Basing org-wide risk decisions on one account's posture. Use the aggregated view so the analysis reflects reality.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examine

Testing procedures

  • Examine documented policies to verify a process is defined for performing a targeted risk analysis for each requirement that allows it, covering all required elements (12.3.1).
  • Examine documentation for cryptographic suites/protocols and hardware/software technologies in use and interview personnel to verify periodic review (12.3.3, 12.3.4).

Evidence in AWS

  • Targeted risk analysis documents with periodicity and decisions.
  • Referenced risk-posture inputs from Security Hub/Config.
  • Evidence of review at least every 12 months.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 12.3 — Up-to-date knowledge and assessment of risks to the CDE are maintained.

AWS services

AWS Security Hub AWS Config

Learning resources

References

  • PCI DSS v4.0.1 Requirement 12.3