A targeted risk analysis is a short, documented justification for how often you perform a PCI DSS activity when the requirement lets you choose. Under 12.3.1 it identifies the assets protected, the threats, what raises likelihood or impact, and why the frequency chosen is enough. It is reviewed at least every 12 months. This is not legal advice.
Where it applies
The SAQ D text for 12.3.1 covers each requirement that provides flexibility on how frequently it is performed. Examples referenced elsewhere in the text include:
- Change and tamper detection on payment pages in 11.6.1, when you choose a frequency other than every seven days.
- Handling lower-risk vulnerabilities in 11.3.1.1.
- Changing application and system account passwords in 8.6.3.
What each analysis must contain
- Identification of the assets being protected.
- Identification of the threats the requirement protects against.
- Factors that contribute to the likelihood or impact of a threat being realized.
- A resulting analysis that determines, with justification, how often the activity must be performed.
- A review at least once every 12 months to see if it is still valid.
- An updated analysis when the review says it is needed.
A template
| Section | What to write |
|---|---|
| Activity | For example, "review payment page integrity" |
| Requirement | The PCI DSS item that allows flexible frequency |
| Assets | Systems and data protected |
| Threats | What could go wrong, in a sentence or two |
| Factors | Exposure, changes, past incidents, existing controls |
| Decision | The chosen frequency, with reasons |
| Owner and date | Who approved and when |
| Next review | No later than 12 months out |
A one page analysis per activity is usually enough. Shared text across activities is fine if each decision is specific.
Pitfalls
- Choosing a longer interval with no written reason.
- Copying a template without naming your own assets.
- Forgetting the annual review.
- Storing it where nobody can find it during an assessment.
The note also says 12.3.2, the customized approach version, does not apply to entities completing a self assessment questionnaire.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how one control maps to several frameworks.
Quick check
Do I need one analysis for the whole standard?
The text asks for one that supports each requirement with flexible frequency, so cover each activity, even if in one document with sections.
Is a risk register entry enough?
Only if it includes the six elements above. Check with your assessor.
On Safeguard: compliance and evidence automation can hold control owners, dates and linked evidence for these records. Try the free scan at gold.safeguard.sh/scan.
Sources
Wording is from v4.0. Confirm in the current version.
Last reviewed: 19 October 2026.
