Re: PCI DSS Information Security Policy

[John Jones <chianime@xxxxxxxxx>]

SANS.org has some free policies.  They're not great IMO - most seem to be
too focused on the contributing author's environment - but can be a
starting point.

There are some relatively inexpensive "policy packs" you can buy.  For a
few hundred $ they give you generic IT policies that address most topics;
you can use them as a draft and customize as needed.

At my employer, who went through the process of getting PCI compliant last
year, we developed something like 30 point policies in addition to the
umbrella policy.  The point policies addressed specific issues like data
retention, encryption standards, segregation of duties, etc.  Basically as
you go through the DSS, the self-assessment questions should tell you what
you need policies and processes for.

On Mon, Mar 30, 2015 at 1:30 PM, Jeff Crosby <jlcrosby@xxxxxxxxxxxxxxxx>
wrote:

> Does anyone have a written information security policy meant to address PCI
> DSS Requirement 12:  "Maintain a policy that addresses information
> security" that I can plagiarize?  :)
>
> Thanks.
>
>
> --
> Jeff Crosby
> UniPro FoodService/Dilgard
> P.O. Box 13369
> Ft. Wayne, IN 46868-3369
> 260-422-7531
> www.dilgardfoods.com
>
> The opinions expressed are my own and not necessarily the opinion of my
> company.  Unless I say so.
> --
> This is the PC Technical Discussion for IBM i (AS/400 and iSeries) Users
> (PcTech) mailing list
> To post a message email: PcTech@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/pctech
> or email: PcTech-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/pctech.