Inbound email is scanned for malware and phishing with unneeded attachment types blocked, and the domain publishes DMARC

The entity must have processes and automated mechanisms that detect phishing attacks and protect personnel from them. A combination of approaches is encouraged, for example anti-spoofing controls (DMARC, SPF, DKIM), link scrubbing and server-side anti-malware that block phishing messages before delivery, and training personnel to spot and report phishing; applying the controls across the whole organisation is recommended but not required. Applicability: the emphasis is on protecting staff who can access in-scope PCI DSS system components. Technical anti-phishing controls under this requirement are separate from security awareness training under Requirement 12.6.3.1; meeting one does not satisfy the other. This was advisory only up to 31 March 2025 and is now required and fully assessed. Objective under the customized approach: mechanisms exist that protect against, and reduce the risk from, phishing attacks. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

evidence an assessor asks for DNS records and mail gateway settings showing DMARC, SPF and DKIM for the entity's domains; Secure e-mail gateway or filtering configuration with phishing detection, link rewriting or sandboxing enabled; Reports of blocked or quarantined phishing messages over the assessment period; Documented process for personnel reporting suspected phishing and how reports are triaged

Put DMARC policy and verification in place to reduce the risk of forged or altered email appearing to come from legitimate domains, beginning with the SPF and DKIM standards.

evidence an assessor asks for DNS records for SPF, DKIM and DMARC with the DMARC policy level; DMARC aggregate reports and review records; Email authentication standard setting the target DMARC policy and rollout timeline; Inventory of sending domains and third-party senders with SPF and DKIM alignment status; DMARC report review records showing unauthorised senders identified and policy moved to quarantine or reject

Stop file types that are not needed from passing through the enterprise email gateway.

evidence an assessor asks for Email gateway blocked file type policy; Gateway logs showing blocked attachments; Email security standard listing file types to block and the business exception process; Gateway attachment policy export blocking executables, scripts and macro-enabled types; Quarantine review records showing blocked file type releases approved by security

Put in place and maintain anti-malware protection on email servers, for example scanning of attachments and/or sandboxing.

evidence an assessor asks for Email server anti-malware and sandboxing configuration; Detection reports showing malicious attachments caught; Email security standard requiring attachment scanning and sandboxing on mail servers; Mail server or cloud email security configuration with signature updates and sandbox detonation enabled; Weekly detection summary showing sandbox verdicts, blocked malware and post-delivery removals

Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events

evidence an assessor asks for EDR coverage report by asset class; File integrity monitoring baseline and drift alerts; Software inventory reconciliation with allowlist; Hardware tamper detection telemetry; Patch and configuration drift dashboard

The entity must have processes and automated mechanisms that detect phishing attacks and protect personnel from them. A combination of approaches is encouraged, for example anti-spoofing controls (DMARC, SPF, DKIM), link scrubbing and server-side anti-malware that block phishing messages before delivery, and training personnel to spot and report phishing; applying the controls across the whole organisation is recommended but not required. Applicability: the emphasis is on protecting staff who can access in-scope PCI DSS system components. Technical anti-phishing controls under this requirement are separate from security awareness training under Requirement 12.6.3.1; meeting one does not satisfy the other. This was advisory only up to 31 March 2025 and is now required and fully assessed. Objective under the customized approach: mechanisms exist that protect against, and reduce the risk from, phishing attacks. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

evidence an assessor asks for DNS records and mail gateway settings showing DMARC, SPF and DKIM for the entity's domains; Secure e-mail gateway or filtering configuration with phishing detection, link rewriting or sandboxing enabled; Reports of blocked or quarantined phishing messages over the assessment period; Documented process for personnel reporting suspected phishing and how reports are triaged

The entity must have processes and automated mechanisms that detect phishing attacks and protect personnel from them. A combination of approaches is encouraged, for example anti-spoofing controls (DMARC, SPF, DKIM), link scrubbing and server-side anti-malware that block phishing messages before delivery, and training personnel to spot and report phishing; applying the controls across the whole organisation is recommended but not required. Applicability: the emphasis is on protecting staff who can access in-scope PCI DSS system components. Technical anti-phishing controls under this requirement are separate from security awareness training under Requirement 12.6.3.1; meeting one does not satisfy the other. This was advisory only up to 31 March 2025 and is now required and fully assessed. Objective under the customized approach: mechanisms exist that protect against, and reduce the risk from, phishing attacks. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

evidence an assessor asks for DNS records and mail gateway settings showing DMARC, SPF and DKIM for the entity's domains; Secure e-mail gateway or filtering configuration with phishing detection, link rewriting or sandboxing enabled; Reports of blocked or quarantined phishing messages over the assessment period; Documented process for personnel reporting suspected phishing and how reports are triaged

Malware protection is to be implemented and backed by appropriate user awareness. Purpose (stated in ISO/IEC 27002:2022): ensures information and associated assets are protected against malware. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.7.

evidence an assessor asks for Statement of Applicability entry for control A.8.7, showing inclusion or justified exclusion, implementation status and the risks it treats; Anti-malware deployment and update status reports across endpoints, servers and gateways; Application allowlisting and malicious website blocking configurations; Email, download and web scanning configuration at gateways and endpoints, including handling of encrypted content; Approved exception records for disabled protections with justification, approver and review date