What is the purpose of 12.10.6 in PCI DSS?

• A. To modify and evolve the incident response plan based on lessons learned and industry developments.
• B. To create a new data retention policy.
• C. To implement new payroll procedures.
• D. To retire old hardware.

Answer: (A)

The key idea here is that incident response plans must stay current. 12.10.6 requires updating the incident response plan after incidents and as the threat landscape evolves. This means regularly revising who to contact, what steps to take for containment, eradication, and recovery, and how to communicate with stakeholders, so the organization can respond more quickly and effectively next time. By incorporating lessons learned from real events and new guidance from the security community, the plan remains practical and aligned with current risks, which is essential for minimizing impact and maintaining PCI DSS compliance.

Other options don’t fit because they address different areas: data retention policy, payroll procedures, or hardware retirement are not about incident response planning or its improvement.