Information Security Policy and Acceptable Use Policy
Target Risk Analysis and PCI Compliance Program
Scope, Security Awareness Training, and HR Background Checks
Third Part Service Providers
Incident Response Plan

Requirements 12.8 and 12.9