What it means
A PCI targeted risk analysis uses documented threat, likelihood, impact, asset, control, and operating context to justify certain frequencies or support customized-approach controls.
Why it matters
A generic annual risk register cannot substitute for analysis tied to the specific PCI requirement, environment, threat scenario, and chosen control frequency.
Practical focus
- Identify the requirement, protected assets, threat events, factors affecting likelihood and impact, existing controls, and residual exposure.
- Explain how the analysis supports the selected frequency or control design and who approved the decision.
- Reperform the analysis on schedule and after material changes, incidents, control failures, or new threats.
- Preserve this evidence: Retain approved definitions, decisions, operating records, exceptions, test results, and change history that show how PCI Targeted Risk Analysis works over time.
- Exercise this failure scenario: A low-frequency control is justified by a one-line “low risk” statement with no asset, threat, evidence, or approval trail.
Common mistakes
- Using PCI Targeted Risk Analysis as a label without defining its scope, owner, decision criteria, and expected evidence.
- Treating a diagram, policy, tool screen, or meeting as proof that PCI Targeted Risk Analysis operates consistently in real work.
- Optimizing for a one-time review while leaving normal operating decisions, exceptions, and handoffs uncontrolled.
- Testing only the expected path and never rehearsing this failure condition: A low-frequency control is justified by a one-line “low risk” statement with no asset, threat, evidence, or approval trail.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: