PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 12 / c12.6
Efficient Incident ResponseSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c12.6 Automated incident response plan

Maintain an incident response plan that enables immediate response on suspicion or confirmation of an account data compromise, with detection, containment, and analysis capabilities on AWS.

Quick Wins
Foundational
Efficient
Optimized
Effort: High Impact: High Applies to CDE: Yes

Requirement 12

Support Information Security with Organizational Policies and Programs

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

12.10 Suspected and confirmed security incidents are responded to immediately
  • 12.10.1 Incident response plan exists and is ready to activate Your responsibility
  • 12.10.2 Incident response plan reviewed and tested at least annually Your responsibility
  • 12.10.3 Specific personnel available 24/7 to respond to incidents Your responsibility
  • 12.10.4 Personnel responsible for incident response trained Your responsibility
  • 12.10.4.1 Frequency of IR training defined by targeted risk analysis Your responsibility
  • 12.10.5 IR plan includes monitoring/responding to security control alerts Covered
  • 12.10.6 IR plan modified/evolved per lessons learned Your responsibility
  • 12.10.7 IR procedures for unexpected stored PAN detection Covered

How to implement on AWS

Document the response plan (roles, communication, escalation) and test it at least annually. Orchestrate playbooks with EventBridge, Lambda, and Step Functions from Security Hub/GuardDuty findings. Prepare forensic capabilities (Amazon Detective, isolated snapshots). Run simulation exercises (game days).

Practical implementation

How this control is implemented in each reference architecture:

Maintain a tested incident response plan with automated detection, containment, and forensic capabilities.

  1. Document the IR plan (roles, communication, escalation, 24/7 coverage) and test it at least annually.
    IR plan
  2. Orchestrate response playbooks with EventBridge, Lambda, and Step Functions triggered by GuardDuty/Security Hub findings.
    Account automation EventBridge AWS Lambda Step Functions GuardDuty
  3. Prepare forensic capabilities (Amazon Detective, isolated EBS snapshots) and run simulation exercises (game days).
    Account-wide Amazon Detective

How to validate: The IR plan exists with all required elements, was tested in the last 12 months, and automated playbooks plus Detective forensics are in place.

Avoid: A plan on paper never exercised. Test it annually with game days so the automation and roles actually work under pressure.

Single-account, 3-tier →

Run incident response from the security tooling account with cross-account reach to contain and investigate in any CDE account.

  1. Operate IR from the security tooling account off the org-wide GuardDuty/Security Hub findings stream.
    Security tooling account GuardDuty Security Hub
  2. Use scoped cross-account roles so responders can contain and investigate in any CDE account, with playbooks in EventBridge/Lambda/Step Functions.
    Security tooling account → CDE accounts EventBridge AWS Lambda Step Functions
  3. Run forensics (Amazon Detective over the central data) and test the plan org-wide with game days.
    Security tooling account Amazon Detective

How to validate: IR operates org-wide from the security account, cross-account containment works in a game-day test, and Detective covers the central data.

Avoid: A separate IR setup per account. Centralize with cross-account roles so response is fast and consistent everywhere.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineinterviewobserve

Testing procedures

  • Examine the incident response plan to verify it exists and includes all required elements, and review prior incidents to confirm the plan was followed (12.10.1.a, 12.10.1.b).
  • Interview personnel and review documentation to verify the plan is reviewed/updated and tested at least every 12 months (12.10.2), that designated personnel are available 24/7 (12.10.3), and that monitoring/alert response is covered (12.10.5).

Evidence in AWS

  • Documented incident response plan and evidence of its annual test.
  • Automated playbooks (EventBridge/Lambda/Step Functions) and their history.
  • Forensic capabilities enabled (Amazon Detective) and game-day records.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 12.10 — Suspected and confirmed security incidents that could affect the CDE are responded to immediately in accordance with a maintained and tested incident response plan.

AWS services

AWS Security Hub Amazon GuardDuty Amazon Detective AWS Step Functions Amazon EventBridge

Learning resources

References

  • AWS Security Maturity Model: Incident response playbooks, Simulations
  • PCI DSS v4.0.1 Requirement 12.10