What item must be included in the alerts used by the incident response process under 12.10.5?

• A. Alerts from security monitoring systems such as IDS/IPS, firewalls, and file-integrity monitors.
• B. Customer feedback surveys.
• C. Marketing analytics.
• D. Outsourcing partner performance metrics.

Answer: (A)

Incident detection hinges on signals from security monitoring tools, and those signals are what drive the incident response process. Under PCI DSS 12.10.5, the incident response plan must incorporate alerts from security monitoring systems—such as intrusion detection and prevention systems, firewalls, and file integrity monitoring. These tools continuously watch for signs of compromise, policy violations, or abnormal activity, and their alerts trigger the response team to initiate containment, investigation, and remediation steps, assign responsibilities, and move the incident through recovery and lessons learned. Other items like customer feedback surveys, marketing analytics, or outsourcing partner performance metrics don’t reflect security events in the environment, so they aren’t appropriate sources for triggering incident response alerts.