Annual risk assessment is documented for cardholder data environment

PCI-DSS 4.0 Req 12.3 requires that a targeted risk analysis is performed for each PCI requirement that provides flexibility; Req 12.3.1 requires it to be documented and reviewed at least annually. A risk assessment is the mechanism by which you discover gaps before an auditor or attacker does — it forces enumeration of CDE assets, threat actors, and compensating controls. ISO 27001:2022 A.6.1.2 (Information Security Risk Assessment) and NIST RA-3 both require periodic, documented risk assessments as the foundation of a security program. Without one, your security posture is reactive rather than managed.

Conduct an annual CDE risk assessment and document it in docs/annual-risk-assessment-YYYY.md. The document must name the assessment date, define the CDE scope explicitly, and list at least three risks with likelihood/impact ratings and named mitigations. Review and update it before each anniversary.

# Annual Risk Assessment: CDE
**Date:** 2026-02-15  **Next:** 2027-02-15

## CDE Scope
Payment API, webhook receiver, cardholder_data table (tokens only), admin panel.

## Risk Register
| Risk                      | Likelihood | Impact   | Mitigation                        | Residual |
|---------------------------|-----------|----------|-----------------------------------|----------|
| Unauthorized CDE access   | Medium    | Critical | MFA + RBAC + audit logging        | Medium   |
| SQL injection in payment  | Low       | Critical | Parameterized queries + pentest   | Low      |
| Dependency CVE exploited  | Medium    | High     | Dependabot + weekly Trivy scan    | Low      |

Reference this document from docs/pci-compliance.md and link it to your incident response plan so the risk assessment feeds directly into your operational controls.