CISM: Certified Information Security Manager

Corporate policies establish the organization’s required governance, responsibilities, risk posture, and control framework for credit card information. Security processes should be designed to conform to those policies before selecting or implementing specific technical controls such as segmentation or encryption. PCI DSS also includes organizational policies and programs as part of payment-data security.