12.4.1 Executive responsibility for a PCI DSS compliance program

Service providers only: executive management must set up responsibility for protecting cardholder data and for a PCI DSS compliance program, covering: overall accountability for keeping PCI DSS compliance; and defining a charter for the compliance program along with communication to executive management. Applicability: applies only where the assessed entity is a service provider. Executive management can mean C-level roles, the board or an equivalent, with titles depending on the organisation's structure; responsibility for the program may be allocated to individual roles and/or business units. Customized approach objective: executives are answerable and accountable for cardholder data security.

Source: PCI DSS v4.0.1, 12.4.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.