PCI DSS 12.10.7: Incident Response for Unexpected PAN Discovery

What this means

This control requires you to establish and maintain incident response procedures specifically designed to handle the discovery of stored PAN in unauthorized locations. When cardholder data appears where it shouldn't—such as unencrypted backups, logs, test environments, or developer systems—your team must have a documented, practiced process to respond immediately. The procedures should cover detection, containment, investigation, remediation, and notification steps to minimize impact and prevent further exposure.

How to comply

1. 1.Document detailed incident response procedures specifically for unexpected PAN discovery scenarios
2. 2.Define roles and responsibilities for detection, containment, and remediation teams
3. 3.Establish clear escalation paths and communication protocols for PAN discovery incidents
4. 4.Create procedures for isolating affected systems to prevent further data exposure
5. 5.Develop investigation steps to determine scope, source, and timeline of PAN exposure
6. 6.Implement automated detection mechanisms to identify unexpected PAN in logs, backups, and repositories
7. 7.Define remediation procedures including secure deletion and system hardening steps
8. 8.Establish notification procedures for affected parties when required by law or contract
9. 9.Test and document incident response procedures through quarterly drills and simulations
10. 10.Maintain incident records and post-incident reviews to improve response capabilities

Evidence auditors look for

• Documented incident response plan with specific procedures for PAN discovery
• Evidence of team training on PAN discovery response procedures
• Automated alerting system logs showing detection of unexpected PAN
• Incident response playbooks tailored to different PAN discovery scenarios
• Records of incident drills and tabletop exercises for PAN discovery response
• System isolation procedures and change logs from past incidents
• Investigation reports documenting PAN discovery root causes and remediation
• Communication templates for incident notification and stakeholder updates
• Evidence of data deletion and system remediation post-incident
• Post-incident review documentation showing lessons learned and process improvements

Frequently asked questions

GRCWatch automates PAN discovery detection by scanning your logs, backups, and systems for unexpected cardholder data, then triggers your documented response workflows to ensure incident response procedures are executed consistently and evidence is automatically captured.

See how GRCWatch handles this control automatically

Related controls