Targeted risk analysis (PCI DSS)
A documented risk assessment for a single PCI DSS 4.0 requirement, justifying how often or how a control is performed.
Earlier versions of the standard gave fixed intervals: review logs daily, inspect terminals periodically. Version 4.0 rewrote several requirements to say "at the frequency defined in the entity's targeted risk analysis" instead. Requirement 12.3.1 spells out what the analysis must cover: the assets being protected, the threats, what makes them likely, and how that reasoning arrives at a frequency. It has to be revisited at least once a year.
Requirement 12.3.2 covers the customized approach, where every control done your own way needs its own targeted analysis. Both became mandatory on 31 March 2025. The name is easily confused with PSD2's transaction risk analysis, which is about something else entirely.