Comparison
PCI DSS vs CPS 234
PCI DSS v4.0.1 · APRA CPS 234 Information Security · data 2026-10-27
Requirement-level comparison of PCI DSS v4.0.1 and APRA CPS 234 Information Security, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 24 APRA CPS 234 Information Security requirements, 23 map to something in PCI DSS, 0 are only loosely related, and 1 have no mapping in our data.
CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.
Likely new work: CPS 234 requirements with no mapping to PCI DSS (1)
| CPS 234 | Requirement | Match | PCI DSS | Evidence |
|---|---|---|---|---|
| Testing control effectiveness · 1 | ||||
| Para 29 | Escalate deficiencies that can't be fixed quickly | No mapping in our data | — | No mapping to PCI DSS in our data. |
Mapped (23)
| CPS 234 | Requirement | Match | PCI DSS | Evidence |
|---|---|---|---|---|
| Roles and responsibilities · 2 | ||||
| Para 13 | Board ultimately responsible for information security | Editorial | 12.1.312.1.412.3.1 | Same topic: Roles & Responsibilities, Risk Management (editorial pick) |
| Para 14 | Define information security roles and responsibilities | Editorial | 12.1.312.1.4 | Same topic: Roles & Responsibilities (editorial pick) |
| Information security capability · 3 | ||||
| Para 15 | Maintain a capability commensurate with threats | Editorial | 12.3.1 | Same topic: Risk Management (editorial pick) |
| Para 16 | Assess third parties' information security capability | Editorial | 6.3.212.8.112.8.2+3 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Para 17 | Keep capability current as threats and vulnerabilities change | Editorial | 6.3.111.3.111.3.2+1 | Same topic: Vulnerability Mgmt, Threat Intelligence (editorial pick) |
| Policy framework · 2 | ||||
| Para 18 | Maintain an information security policy framework | Editorial | 12.1.112.1.2 | Same topic: Governance Policy (editorial pick) |
| Para 19 | Policies direct everyone with security obligations | Editorial | 12.1.112.1.2 | Same topic: Governance Policy (editorial pick) |
| Information asset identification and classification · 1 | ||||
| Para 20 | Classify information assets by criticality and sensitivity | Editorial | 6.3.29.4.212.5.1 | Same topic: Asset Management, Data Classification (editorial pick) |
| Implementation of controls · 2 | ||||
| Para 21 | Timely controls commensurate with risk and asset life-cycle | Editorial | 3.2.13.3.13.4.1+1 | Same topic: Data Protection (editorial pick) |
| Para 22 | Evaluate the design of third parties' controls | Editorial | 6.3.212.8.112.8.2+3 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Incident management · 4 | ||||
| Para 23 | Detect and respond to incidents in a timely manner | Editorial | 11.5.112.10.112.10.2+2 | Same topic: Intrusion Detection, Incident Response (editorial pick) |
| Para 24 | Maintain information security response plans | Editorial | 12.10.112.10.212.10.3+1 | Same topic: Incident Response (editorial pick) |
| Para 25 | Response plans cover all stages and escalation | Editorial | 12.10.112.10.212.10.3+2 | Same topic: Incident Response (editorial pick) |
| Para 26 | Review and test response plans annually | Editorial | 12.10.112.10.212.10.3+1 | Same topic: Incident Response (editorial pick) |
| Testing control effectiveness · 4 | ||||
| Para 27 | Systematic testing programme for control effectiveness | Editorial | 6.3.111.3.111.3.2+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| Para 28 | Check third parties' control testing is adequate | Editorial | 12.8.112.8.212.8.3+2 | Same topic: Vendor Risk Mgmt (editorial pick) |
| Para 30 | Testing by skilled, functionally independent specialists | Editorial | 6.3.111.3.111.3.2 | Same topic: Vulnerability Mgmt (editorial pick) |
| Para 31 | Review the testing programme at least annually | Editorial | 12.3.1 | Same topic: Risk Management (editorial pick) |
| Internal audit · 3 | ||||
| Para 32 | Internal audit reviews control design and effectiveness | Editorial | 12.4.2 | Same topic: Compliance (editorial pick) |
| Para 33 | Assurance provided by appropriately skilled personnel | Editorial | 12.4.2 | Same topic: Compliance (editorial pick) |
| Para 34 | Internal audit assesses third-party assurance relied on | Editorial | 12.4.212.8.112.8.2+3 | Same topic: Compliance, Vendor Risk Mgmt (editorial pick) |
| APRA notification · 2 | ||||
| Para 35 | Notify APRA of material incidents within 72 hours | Editorial | 12.10.1 | Same topic: Reporting (editorial pick) |
| Para 36 | Notify APRA of material control weaknesses within 10 business days | Editorial | 12.10.1 | Same topic: Reporting (editorial pick) |
Of 260 PCI DSS v4.0.1 requirements, 26 map to something in CPS 234, 80 are only loosely related, and 154 have no mapping in our data.
Likely new work: PCI DSS requirements with no mapping to CPS 234 (154)
| PCI DSS | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| Requirement 1: Install and maintain network security controls · 15 | ||||
| 1.2.1 | Configuration standards for network security controls | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.2.2 | Network connection changes go through change control | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.2.5 | Allowed services, protocols and ports approved | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.2.6 | Security features defined for insecure services | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.2.7 | Network security control rules reviewed every six months | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.2.8 | Network security control configuration files secured | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.3.1 | Inbound traffic to the CDE restricted | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.3.2 | Outbound traffic from the CDE restricted | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.3.3 | Network controls between wireless networks and the CDE | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.4.1 | Network controls between trusted and untrusted networks | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.4.2 | Inbound traffic from untrusted networks restricted | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.4.3 | Anti-spoofing measures in place | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.4.4 | Stored cardholder data not reachable from untrusted networks | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.4.5 | Internal IP addresses and routing not disclosed | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 1.5.1 | Controls on devices connecting to untrusted networks and the CDE | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Requirement 2: Apply secure configurations to all system components · 8 | ||||
| 2.2.1 | System configuration standards developed and maintained | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 2.2.2 | Vendor default accounts managed or removed | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 2.2.3 | Functions with different security levels kept apart | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 2.2.4 | Only necessary services and functions enabled | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 2.2.5 | Insecure services justified and secured | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 2.2.6 | System security parameters set to prevent misuse | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 2.2.7 | Non-console administrative access encrypted | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 2.3.2 | Wireless keys changed when key holders leave | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Requirement 3: Protect stored account data · 14 | ||||
| 3.3.1.1 | Full track data not kept after authorisation | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.3.1.2 | Card verification code not kept after authorisation | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.3.1.3 | PIN and PIN block not kept after authorisation | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.3.2 | Sensitive authentication data encrypted before authorisation | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.3.3 | Issuer storage of sensitive authentication data limited and protected | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.5.1.1 | Hashes of PAN are keyed cryptographic hashes | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.5.1.2 | Disk-level encryption used only where it suffices | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.7.2 | Key management: secure key distribution | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.7.3 | Key management: secure key storage | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.7.5 | Key management: retiring weakened or compromised keys | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.7.6 | Key management: split knowledge and dual control | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.7.7 | Key management: preventing unauthorised key substitution | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.7.8 | Key custodians formally acknowledge their responsibilities | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3.7.9 | Service providers give customers key-handling guidance | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Requirement 4: Protect cardholder data with strong cryptography during transmission · 2 | ||||
| 4.2.1.2 | Strong cryptography on wireless networks carrying PAN | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 4.2.2 | PAN secured when sent by end-user messaging | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Requirement 5: Protect all systems and networks from malicious software · 8 | ||||
| 5.2.1 | Anti-malware deployed on system components | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 5.2.2 | Anti-malware detects, removes or contains known malware | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 5.2.3 | Systems without anti-malware periodically re-evaluated | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 5.3.1 | Anti-malware kept up to date | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 5.3.2 | Periodic scans or continuous behavioural analysis | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 5.3.3 | Removable media scanned or analysed | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 5.3.4 | Anti-malware audit logs enabled and retained | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 5.3.5 | Users cannot disable or alter anti-malware | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Requirement 6: Develop and maintain secure systems and software · 7 | ||||
| 6.4.1 | Public web applications protected against attacks | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 6.5.1 | Production changes follow change control procedures | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 6.5.2 | PCI DSS requirements re-confirmed after significant changes | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 6.5.3 | Pre-production environments separated from production | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 6.5.4 | Duties separated between production and pre-production | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 6.5.5 | Live PANs not used in pre-production | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 6.5.6 | Test data and accounts removed before go-live | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Requirement 7: Restrict access to system components and cardholder data by business need to know · 7 | ||||
| 7.2.1 | Access control model defined | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 7.2.3 | Privileges approved by authorised personnel | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 7.2.5 | System and application accounts least privilege | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 7.2.6 | Access to cardholder data repositories restricted | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 7.3.1 | Access control system restricts access by need | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 7.3.2 | Access control system enforces assigned permissions | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 7.3.3 | Access control system set to deny by default | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Requirement 8: Identify users and authenticate access to system components · 25 | ||||
| 8.2.1 | Every user has a unique ID | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.2.2 | Shared or generic accounts only by documented exception | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.2.3 | Service providers use unique credentials per customer | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.2.4 | User ID changes authorised and controlled | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.2.5 | Access revoked immediately on termination | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.2.6 | Inactive user accounts disabled within 90 days | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.2.7 | Third-party remote access accounts enabled only when needed | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.3.1 | User and admin access requires an authentication factor | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.3.2 | Authentication factors unreadable in transit and storage | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.3.3 | Identity verified before changing authentication factors | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.3.4 | Account lockout after repeated failed attempts | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.3.5 | First-use and reset passwords unique and changed | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.3.6 | Minimum password length and complexity | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.3.7 | Recent passwords cannot be reused | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.3.8 | Authentication guidance communicated to users | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.3.9 | Password-only access: change every 90 days or analyse risk | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.3.10 | Service providers give customers password guidance | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.3.10.1 | Service provider customer passwords: rotation or analysis | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.3.11 | Tokens, smart cards and certificates assigned to individuals | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.4.1 | MFA for non-console administrative access to the CDE | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.4.2 | MFA for all access into the CDE | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.4.3 | MFA for remote network access | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.5.1 | MFA systems configured to resist misuse | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.6.1 | Interactive use of system accounts managed | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8.6.2 | No hard-coded passwords for system accounts | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Requirement 9: Restrict physical access to cardholder data · 19 | ||||
| 9.2.1 | Facility entry controls restrict CDE access | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.2.1.1 | Access to sensitive areas monitored by camera or access control | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.2.2 | Publicly accessible network jacks restricted | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.2.3 | Physical access to network hardware restricted | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.2.4 | Consoles in sensitive areas locked when unattended | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.3.1 | Personnel physical access authorised and managed | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.3.1.1 | Sensitive-area access authorised and revoked promptly | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.3.2 | Visitor access authorised, escorted and identifiable | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.3.3 | Visitor badges returned or deactivated | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.3.4 | Visitor log maintained and retained | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.4.1 | Media with cardholder data physically secured | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.4.1.1 | Offline backup media stored securely | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.4.1.2 | Security of offline backup location reviewed annually | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.4.3 | Media sent off site tracked and secured | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.4.4 | Management approves media moved off site | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.4.5 | Inventory logs of electronic media kept | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.4.5.1 | Electronic media inventories at least annually | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.5.1 | Card-reading (POI) devices protected from tampering | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9.5.1.3 | Staff trained to spot POI tampering | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Requirement 10: Log and monitor all access to system components and cardholder data · 17 | ||||
| 10.2.1.1 | Logs capture user access to cardholder data | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.2.1.2 | Logs capture administrative actions | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.2.1.3 | Logs capture access to audit logs | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.2.1.4 | Logs capture invalid access attempts | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.2.1.5 | Logs capture credential and privilege changes | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.2.1.6 | Logs capture starting, stopping or pausing logging | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.2.1.7 | Logs capture system-level object changes | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.2.2 | Log entries record who, what, when, where and outcome | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.3.1 | Read access to logs limited to need | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.3.2 | Logs protected from modification | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.4.2 | Other logs reviewed periodically | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.4.3 | Exceptions and anomalies addressed | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.6.1 | System clocks synchronised | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.6.2 | Time configuration correct and consistent | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.6.3 | Time settings protected from change | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.7.1 | Service providers detect security control failures | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10.7.3 | Security control failures responded to promptly | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Requirement 11: Test security of systems and networks regularly · 12 | ||||
| 11.2.2 | Inventory of authorised wireless access points | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 11.3.1.2 | Internal scans use authenticated scanning | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 11.3.1.3 | Internal scans after significant changes | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 11.3.2.1 | External scans after significant changes | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 11.4.1 | Penetration testing methodology defined | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 11.4.2 | Internal penetration test at least annually | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 11.4.3 | External penetration test at least annually | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 11.4.5 | Segmentation controls tested at least annually | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 11.4.6 | Service providers test segmentation every six months | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 11.4.7 | Multi-tenant providers support customer penetration tests | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 11.5.1.1 | Service providers detect covert malware communication | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 11.5.2 | Change-detection on critical files | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Requirement 12: Support information security with organizational policies and programs · 10 | ||||
| 12.2.1 | Acceptable use policies for end-user technologies | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 12.4.1 | Service providers: executive responsibility for PCI DSS compliance | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 12.4.2.1 | Service providers: quarterly review results documented | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 12.5.2.1 | Service providers confirm scope every six months | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 12.6.2 | Awareness programme reviewed annually | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 12.6.3 | Awareness training on hire and at least annually | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 12.6.3.1 | Training covers phishing and social engineering | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 12.6.3.2 | Training covers acceptable use of technology | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 12.7.1 | Personnel screened before hire | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 12.10.5 | Plan covers alerts from security monitoring | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Appendix A: additional requirements · 10 | ||||
| A1.1.1 | Multi-tenant providers: separate provider and customer environments | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A1.1.2 | Multi-tenant providers: customers confined to their own environment | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A1.1.3 | Multi-tenant providers: customers reach only their own data | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A1.1.4 | Multi-tenant providers: separation tested every six months | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A1.2.1 | Multi-tenant providers: audit logging for each customer | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A1.2.2 | Multi-tenant providers: support customer forensic investigations | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A1.2.3 | Multi-tenant providers: report suspected incidents to customers | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A2.1.1 | POI terminals using SSL or early TLS not exploitable | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A2.1.2 | Service providers: migration plan off SSL and early TLS | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A2.1.3 | Service providers offer a secure connection option | No mapping in our data | — | No mapping to CPS 234 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (80)
| PCI DSS | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| Requirement 1: Install and maintain network security controls · 4 | ||||
| 1.1.1 | Network security policies documented and kept current | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| 1.1.2 | Roles for network security controls assigned | Para 13Para 14 | Only shares CSF GV.RR-02: related, not a mapping | |
| 1.2.3 | Accurate network diagram maintained | Para 16Para 22Para 20+2 | Only shares CSF GV.SC-01, GV.SC-06, ID.AM-01: related, not a mapping | |
| 1.2.4 | Accurate account-data flow diagram maintained | Para 16Para 22Para 28+2 | Only shares CSF GV.SC-01, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping | |
| Requirement 2: Apply secure configurations to all system components · 3 | ||||
| 2.1.1 | Secure configuration policies documented and kept current | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| 2.1.2 | Roles for secure configuration assigned | Para 13Para 14 | Only shares CSF GV.RR-02: related, not a mapping | |
| 2.3.1 | Wireless vendor defaults changed | Para 21 | Only shares CSF PR.DS-02: related, not a mapping | |
| Requirement 3: Protect stored account data · 12 | ||||
| 3.1.1 | Stored account data policies documented and kept current | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| 3.1.2 | Roles for protecting stored account data assigned | Para 13Para 14 | Only shares CSF GV.RR-02: related, not a mapping | |
| 3.4.2 | PAN copying prevented over remote-access technologies | Para 21Para 20 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, ID.AM-07: related, not a mapping | |
| 3.5.1 | PAN rendered unreadable wherever stored | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| 3.5.1.3 | Disk encryption access managed separately from OS access | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| 3.6.1 | Procedures protect keys that secure stored account data | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| 3.6.1.1 | Service providers document their cryptographic architecture | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| 3.6.1.2 | Secret and private keys stored in approved forms | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| 3.6.1.3 | Cleartext key components accessible to fewest custodians | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| 3.6.1.4 | Keys stored in the fewest possible locations | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| 3.7.1 | Key management: strong key generation | Para 21 | Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| 3.7.4 | Key management: key changes at end of cryptoperiod | Para 21 | Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| Requirement 4: Protect cardholder data with strong cryptography during transmission · 4 | ||||
| 4.1.1 | Data-in-transit policies documented and kept current | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| 4.1.2 | Roles for protecting data in transit assigned | Para 13Para 14 | Only shares CSF GV.RR-02: related, not a mapping | |
| 4.2.1 | Strong cryptography for PAN over open, public networks | Para 21 | Only shares CSF PR.DS-02: related, not a mapping | |
| 4.2.1.1 | Inventory of trusted keys and certificates kept | Para 21 | Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| Requirement 5: Protect all systems and networks from malicious software · 5 | ||||
| 5.1.1 | Anti-malware policies documented and kept current | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| 5.1.2 | Roles for malware protection assigned | Para 13Para 14 | Only shares CSF GV.RR-02: related, not a mapping | |
| 5.2.3.1 | Re-evaluation frequency set by targeted risk analysis | Para 13Para 15Para 27+1 | Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping | |
| 5.3.2.1 | Scan frequency set by targeted risk analysis | Para 13Para 15Para 27+1 | Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping | |
| 5.4.1 | Mechanisms to detect and protect against phishing | Para 21 | Only shares CSF PR.DS-02: related, not a mapping | |
| Requirement 6: Develop and maintain secure systems and software · 10 | ||||
| 6.1.1 | Secure systems and software policies documented | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| 6.1.2 | Roles for secure systems and software assigned | Para 13Para 14 | Only shares CSF GV.RR-02: related, not a mapping | |
| 6.2.1 | Bespoke and custom software developed securely | Para 20 | Only shares CSF ID.AM-08: related, not a mapping | |
| 6.2.2 | Developers trained in secure software development | Para 13Para 14Para 20 | Only shares CSF GV.RR-01, ID.AM-08: related, not a mapping | |
| 6.2.3 | Custom code reviewed before release | Para 16Para 22Para 20 | Only shares CSF GV.SC-03, GV.SC-09, ID.AM-08: related, not a mapping | |
| 6.2.3.1 | Manual code reviews approved by someone else | Para 20 | Only shares CSF ID.AM-08: related, not a mapping | |
| 6.2.4 | Coding techniques prevent common software attacks | Para 20 | Only shares CSF ID.AM-08: related, not a mapping | |
| 6.3.3 | Security patches installed promptly | Para 13Para 15Para 17+5 | Only shares CSF GV.RM-03, GV.RM-06, ID.RA-05, ID.RA-06: related, not a mapping | |
| 6.4.2 | Automated solution blocks attacks on public web apps | Para 23 | Only shares CSF DE.CM-01: related, not a mapping | |
| 6.4.3 | Payment page scripts authorised and integrity-checked | Para 16Para 22Para 17+3 | Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping | |
| Requirement 7: Restrict access to system components and cardholder data by business need to know · 5 | ||||
| 7.1.1 | Access restriction policies documented and kept current | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| 7.1.2 | Roles for access restriction assigned | Para 13Para 14 | Only shares CSF GV.RR-02: related, not a mapping | |
| 7.2.2 | Access assigned by job function and least privilege | Para 21 | Only shares CSF PR.DS-10: related, not a mapping | |
| 7.2.4 | User accounts and privileges reviewed every six months | Para 16Para 22Para 28+1 | Only shares CSF DE.CM-06: related, not a mapping | |
| 7.2.5.1 | System and application account access periodically reviewed | Para 13Para 15Para 27+4 | Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping | |
| Requirement 8: Identify users and authenticate access to system components · 4 | ||||
| 8.1.1 | Identification and authentication policies documented | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| 8.1.2 | Roles for identification and authentication assigned | Para 13Para 14 | Only shares CSF GV.RR-02: related, not a mapping | |
| 8.2.8 | Re-authentication after 15 minutes idle | Para 21 | Only shares CSF PR.DS-10: related, not a mapping | |
| 8.6.3 | System account passwords protected and changed | Para 13Para 15Para 27+1 | Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping | |
| Requirement 9: Restrict physical access to cardholder data · 7 | ||||
| 9.1.1 | Physical security policies documented and kept current | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| 9.1.2 | Roles for physical security assigned | Para 13Para 14 | Only shares CSF GV.RR-02: related, not a mapping | |
| 9.4.6 | Hard-copy media destroyed when no longer needed | Para 21Para 32Para 33+1 | Only shares CSF PR.DS-01, GV.OC-03: related, not a mapping | |
| 9.4.7 | Electronic media destroyed or made unrecoverable | Para 21Para 32Para 33+1 | Only shares CSF PR.DS-01, GV.OC-03: related, not a mapping | |
| 9.5.1.1 | Inventory of POI devices kept | Para 16Para 22Para 20 | Only shares CSF GV.SC-09, ID.RA-09, ID.AM-01: related, not a mapping | |
| 9.5.1.2 | POI devices inspected for tampering | Para 16Para 20Para 22 | Only shares CSF GV.SC-09, ID.AM-01: related, not a mapping | |
| 9.5.1.2.1 | Inspection frequency set by targeted risk analysis | Para 13Para 15Para 27+4 | Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping | |
| Requirement 10: Log and monitor all access to system components and cardholder data · 10 | ||||
| 10.1.1 | Logging and monitoring policies documented | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| 10.1.2 | Roles for logging and monitoring assigned | Para 13Para 14 | Only shares CSF GV.RR-02: related, not a mapping | |
| 10.2.1 | Audit logs enabled and active | Para 23Para 16Para 22+5 | Only shares CSF DE.AE-02, DE.CM-01, RS.MA-02, DE.CM-06: related, not a mapping | |
| 10.3.3 | Logs promptly backed up to a central server | Para 23 | Only shares CSF DE.AE-02: related, not a mapping | |
| 10.3.4 | File-integrity monitoring on logs | Para 23 | Only shares CSF DE.AE-02: related, not a mapping | |
| 10.4.1 | Security event and critical logs reviewed daily | Para 23Para 24Para 25+1 | Only shares CSF DE.AE-02, DE.CM-01, RS.MA-02, RS.MA-03: related, not a mapping | |
| 10.4.1.1 | Automated mechanisms for log review | Para 23 | Only shares CSF DE.AE-02: related, not a mapping | |
| 10.4.2.1 | Review frequency set by targeted risk analysis | Para 13Para 15Para 27+3 | Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping | |
| 10.5.1 | Audit logs retained 12 months, three immediately available | Para 25 | Only shares CSF RC.RP-06: related, not a mapping | |
| 10.7.2 | Critical security control failures detected and reported | Para 32Para 33Para 34 | Only shares CSF GV.OV-03: related, not a mapping | |
| Requirement 11: Test security of systems and networks regularly · 6 | ||||
| 11.1.1 | Security testing policies documented and kept current | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| 11.1.2 | Roles for security testing assigned | Para 13Para 14 | Only shares CSF GV.RR-02: related, not a mapping | |
| 11.2.1 | Wireless access points detected and unauthorised ones handled | Para 23 | Only shares CSF DE.CM-01: related, not a mapping | |
| 11.3.1.1 | Lower-ranked vulnerabilities handled by risk analysis | Para 13Para 15Para 27+3 | Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping | |
| 11.4.4 | Penetration test findings corrected and retested | Para 17Para 27Para 30+3 | Only shares CSF ID.RA-01: related, not a mapping | |
| 11.6.1 | Payment page changes and tampering detected | Para 16Para 22Para 13+5 | Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping | |
| Requirement 12: Support information security with organizational policies and programs · 10 | ||||
| 12.3.2 | Targeted risk analysis for customised approach | Para 13Para 15Para 27+1 | Only shares CSF GV.RM-06: related, not a mapping | |
| 12.3.3 | Cipher suites and protocols reviewed annually | Para 13Para 15Para 27+2 | Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping | |
| 12.3.4 | Hardware and software technologies reviewed annually | Para 13Para 15Para 16+5 | Only shares CSF GV.RM-03, GV.RM-06, GV.SC-03, GV.SC-09: related, not a mapping | |
| 12.5.2 | PCI DSS scope confirmed annually and on change | Para 16Para 22Para 28+2 | Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping | |
| 12.5.3 | Service providers review scope after organisational change | Para 13Para 15Para 27+1 | Only shares CSF GV.RM-03: related, not a mapping | |
| 12.6.1 | Formal security awareness programme | Para 13Para 14Para 18+1 | Only shares CSF GV.RR-01, GV.PO-01: related, not a mapping | |
| 12.9.1 | Service providers acknowledge responsibilities to customers | Para 16Para 22Para 34+3 | Only shares CSF GV.SC-01, GV.SC-05, GV.SC-07, GV.OC-03: related, not a mapping | |
| 12.9.2 | Service providers support customer compliance requests | Para 16Para 22Para 34+3 | Only shares CSF GV.SC-01, GV.SC-05, GV.SC-07, GV.OC-03: related, not a mapping | |
| 12.10.4.1 | Training frequency set by targeted risk analysis | Para 13Para 15Para 27+1 | Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping | |
| 12.10.7 | Procedures for PAN found where it shouldn't be | Para 20 | Only shares CSF ID.AM-07: related, not a mapping | |
Mapped (26)
| PCI DSS | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| Requirement 3: Protect stored account data · 3 | ||||
| 3.2.1 | Account data storage minimised, with retention and disposal | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| 3.3.1 | Sensitive authentication data not kept after authorisation | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| 3.4.1 | PAN masked when displayed | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| Requirement 6: Develop and maintain secure systems and software · 2 | ||||
| 6.3.1 | Vulnerabilities identified and risk-ranked | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt, Threat Intelligence (editorial pick) |
| 6.3.2 | Inventory of custom software and its components | Editorial | Para 16Para 20Para 22 | Same topic: Supply Chain Risk, Asset Management (editorial pick) |
| Requirement 9: Restrict physical access to cardholder data · 1 | ||||
| 9.4.2 | Media classified by data sensitivity | Editorial | Para 20 | Same topic: Data Classification (editorial pick) |
| Requirement 11: Test security of systems and networks regularly · 3 | ||||
| 11.3.1 | Internal vulnerability scans every three months | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| 11.3.2 | External ASV scans every three months | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| 11.5.1 | Intrusion detection or prevention on network traffic | Editorial | Para 23 | Same topic: Intrusion Detection (editorial pick) |
| Requirement 12: Support information security with organizational policies and programs · 17 | ||||
| 12.1.1 | Information security policy established and published | Editorial | Para 18Para 19 | Same topic: Governance Policy (editorial pick) |
| 12.1.2 | Security policy reviewed at least annually | Editorial | Para 18Para 19 | Same topic: Governance Policy (editorial pick) |
| 12.1.3 | Security roles and responsibilities defined | Editorial | Para 13Para 14 | Same topic: Roles & Responsibilities (editorial pick) |
| 12.1.4 | Executive responsibility for information security assigned | Editorial | Para 13Para 14 | Same topic: Roles & Responsibilities (editorial pick) |
| 12.3.1 | Targeted risk analysis for flexible-frequency requirements | Editorial | Para 13Para 15Para 17+3 | Same topic: Risk Management, Risk Assessment (editorial pick) |
| 12.4.2 | Service providers: quarterly reviews of operational tasks | Editorial | Para 32Para 33Para 34 | Same topic: Compliance (editorial pick) |
| 12.5.1 | Inventory of in-scope system components | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| 12.8.1 | List of third-party service providers kept | Editorial | Para 16Para 22Para 28+1 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| 12.8.2 | Written agreements with service providers | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| 12.8.3 | Due diligence before engaging service providers | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| 12.8.4 | Service provider compliance monitored annually | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| 12.8.5 | Responsibilities split with each provider documented | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| 12.10.1 | Incident response plan ready to activate | Editorial | Para 23Para 24Para 25+3 | Same topic: Incident Response (editorial pick) |
| 12.10.2 | Incident response plan reviewed and tested annually | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| 12.10.3 | Incident response staff available around the clock | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| 12.10.4 | Incident response staff trained | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| 12.10.6 | Plan updated from lessons learned and industry changes | Editorial | Para 25 | Same topic: Lessons Learned (editorial pick) |
By topic
Both cover (16):
Governance PolicyRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentData ClassificationVulnerability MgmtThreat IntelligenceData ProtectionIntrusion DetectionIncident ResponseReportingLessons LearnedVendor Risk Mgmt
Only PCI DSS (30):
Awareness & TrainingBusiness EnvironmentAccess ControlMulti-Factor AuthEncryptionBackup & RecoveryPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigSecure DevelopmentEmail SecurityWeb SecurityZero TrustCloud SecurityWAFDLPCont. MonitoringLogging & AuditAnomaly DetectionSIEM / SOCForensicsMitigationRecovery PlanningBusiness ContinuityDisaster RecoveryAPI SecurityInsider ThreatPhysical Security
Only CPS 234 (1):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.