PCI DSS 12.1.3: Define Information Security Roles and Responsibilities

What this means

PCI DSS 12.1.3 requires your organization to create and maintain clear documentation of information security roles and responsibilities across all personnel levels. This control ensures that every employee, contractor, and third party knows their security obligations, who is accountable for specific security functions, and how roles connect to your overall security posture. Without defined roles, security efforts become fragmented and accountability disappears.

How to comply

1. 1.Document all information security roles in your written security policy, including job titles, departments, and specific responsibilities
2. 2.Define role-specific security responsibilities for management, developers, IT staff, administrators, and end-users
3. 3.Establish clear accountability chains showing who reports to whom and who has final decision-making authority for security matters
4. 4.Include responsibility assignments for policy development, incident response, access control, audit logging, and security training
5. 5.Map roles to security functions required by PCI DSS (e.g., vulnerability management, change control, access reviews)
6. 6.Communicate role definitions to all employees during onboarding and annual security awareness training
7. 7.Review and update role definitions annually or when organizational structure changes
8. 8.Ensure your policy addresses roles for third-party service providers and contractors

Evidence auditors look for

• Information Security Policy document with dedicated section on roles and responsibilities
• Role matrix mapping job titles to specific security duties and approval authorities
• Organizational chart showing security function hierarchy and reporting relationships
• Job descriptions or role profiles that include security-related responsibilities
• Email confirmations or sign-offs from employees acknowledging their assigned security roles
• Training attendance records demonstrating that employees received role-specific security training
• Access control logs showing proper segregation of duties based on defined roles
• Incident response plan naming specific individuals or teams responsible for each response phase

Frequently asked questions

GRCWatch automates role assignment tracking and generates audit-ready role matrices that stay synchronized with your actual team structure, eliminating manual policy updates every time personnel changes occur.

See how GRCWatch handles this control automatically

Related controls