Targeted risk analysis (TRA) is one of the most flexible parts of PCI DSS 4.0, and one of the most misunderstood.
When you need a TRA
Several requirements let you define how often a control runs. Each of them needs a documented analysis that explains your choice.
What a good TRA includes
- The asset and the threat you are protecting against
- How likely the threat is in your environment
- Why the chosen frequency is enough
- Who approved it and when it will be reviewed
Keep it short, specific and tied to your real environment.
