Comparison

PCI DSS vs Cyber Essentials

PCI DSS v4.0.1 · UK Cyber Essentials (NCSC) · data 2026-10-27

Requirement-level comparison of PCI DSS v4.0.1 and UK Cyber Essentials (NCSC), in both directions, derived from published crosswalks and ControlMapping's curated topics.

Have PCI DSS → need Cyber Essentials

5 reqs

5 mapped · · 0 no mapping Open in gap view →

Of 5 UK Cyber Essentials (NCSC) requirements, 5 map to something in PCI DSS, 0 are only loosely related, and 0 have no mapping in our data.

Cyber Essentials certifies five technical controls only; governance, risk assessment, incident response and backup are deliberately outside its scope. All links are editorial.

Mapped (5)

Cyber Essentials	Requirement	Match	PCI DSS	Evidence
Technical controls · 5
CE 1	Firewalls	Editorial	1.2.1 1.2.3 1.3.1+1	Same topic: Firewall / Net Seg (editorial pick)
CE 2	Secure Configuration	Editorial	2.2.1 2.2.2	Same topic: Secure Config (editorial pick)
CE 3	Security Update Management	Editorial	6.3.1 6.3.2 6.3.3+3	Same topic: Vulnerability Mgmt, Patch Management, Asset Management (editorial pick)
CE 4	User Access Control	Editorial	7.2.1 7.2.2 7.2.4+7	Same topic: Access Control, Privileged Access (editorial pick)
CE 5	Malware protection	Editorial	5.2.1 5.2.2 5.3.2	Same topic: Endpoint Protection (editorial pick)

Have Cyber Essentials → need PCI DSS

260 reqs

25 mapped · · 188 no mapping Open in gap view →

Of 260 PCI DSS v4.0.1 requirements, 25 map to something in Cyber Essentials, 47 are only loosely related, and 188 have no mapping in our data.

Likely new work: PCI DSS requirements with no mapping to Cyber Essentials (188)

PCI DSS	Requirement	Match	Cyber Essentials	Evidence
Requirement 1: Install and maintain network security controls · 14
1.1.1	Network security policies documented and kept current	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.1.2	Roles for network security controls assigned	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.2.2	Network connection changes go through change control	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.2.5	Allowed services, protocols and ports approved	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.2.6	Security features defined for insecure services	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.2.7	Network security control rules reviewed every six months	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.2.8	Network security control configuration files secured	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.3.2	Outbound traffic from the CDE restricted	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.3.3	Network controls between wireless networks and the CDE	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.4.2	Inbound traffic from untrusted networks restricted	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.4.3	Anti-spoofing measures in place	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.4.4	Stored cardholder data not reachable from untrusted networks	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.4.5	Internal IP addresses and routing not disclosed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.5.1	Controls on devices connecting to untrusted networks and the CDE	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Requirement 2: Apply secure configurations to all system components · 8
2.1.1	Secure configuration policies documented and kept current	No mapping in our data	—	No mapping to Cyber Essentials in our data.
2.1.2	Roles for secure configuration assigned	No mapping in our data	—	No mapping to Cyber Essentials in our data.
2.2.3	Functions with different security levels kept apart	No mapping in our data	—	No mapping to Cyber Essentials in our data.
2.2.4	Only necessary services and functions enabled	No mapping in our data	—	No mapping to Cyber Essentials in our data.
2.2.5	Insecure services justified and secured	No mapping in our data	—	No mapping to Cyber Essentials in our data.
2.2.6	System security parameters set to prevent misuse	No mapping in our data	—	No mapping to Cyber Essentials in our data.
2.2.7	Non-console administrative access encrypted	No mapping in our data	—	No mapping to Cyber Essentials in our data.
2.3.2	Wireless keys changed when key holders leave	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Requirement 3: Protect stored account data · 23
3.1.1	Stored account data policies documented and kept current	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.1.2	Roles for protecting stored account data assigned	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.2.1	Account data storage minimised, with retention and disposal	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.3.1	Sensitive authentication data not kept after authorisation	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.3.1.1	Full track data not kept after authorisation	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.3.1.2	Card verification code not kept after authorisation	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.3.1.3	PIN and PIN block not kept after authorisation	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.3.2	Sensitive authentication data encrypted before authorisation	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.3.3	Issuer storage of sensitive authentication data limited and protected	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.4.1	PAN masked when displayed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.4.2	PAN copying prevented over remote-access technologies	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.5.1	PAN rendered unreadable wherever stored	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.5.1.1	Hashes of PAN are keyed cryptographic hashes	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.5.1.2	Disk-level encryption used only where it suffices	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.7.1	Key management: strong key generation	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.7.2	Key management: secure key distribution	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.7.3	Key management: secure key storage	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.7.4	Key management: key changes at end of cryptoperiod	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.7.5	Key management: retiring weakened or compromised keys	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.7.6	Key management: split knowledge and dual control	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.7.7	Key management: preventing unauthorised key substitution	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.7.8	Key custodians formally acknowledge their responsibilities	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.7.9	Service providers give customers key-handling guidance	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Requirement 4: Protect cardholder data with strong cryptography during transmission · 6
4.1.1	Data-in-transit policies documented and kept current	No mapping in our data	—	No mapping to Cyber Essentials in our data.
4.1.2	Roles for protecting data in transit assigned	No mapping in our data	—	No mapping to Cyber Essentials in our data.
4.2.1	Strong cryptography for PAN over open, public networks	No mapping in our data	—	No mapping to Cyber Essentials in our data.
4.2.1.1	Inventory of trusted keys and certificates kept	No mapping in our data	—	No mapping to Cyber Essentials in our data.
4.2.1.2	Strong cryptography on wireless networks carrying PAN	No mapping in our data	—	No mapping to Cyber Essentials in our data.
4.2.2	PAN secured when sent by end-user messaging	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Requirement 5: Protect all systems and networks from malicious software · 7
5.1.1	Anti-malware policies documented and kept current	No mapping in our data	—	No mapping to Cyber Essentials in our data.
5.1.2	Roles for malware protection assigned	No mapping in our data	—	No mapping to Cyber Essentials in our data.
5.3.1	Anti-malware kept up to date	No mapping in our data	—	No mapping to Cyber Essentials in our data.
5.3.2.1	Scan frequency set by targeted risk analysis	No mapping in our data	—	No mapping to Cyber Essentials in our data.
5.3.3	Removable media scanned or analysed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
5.3.4	Anti-malware audit logs enabled and retained	No mapping in our data	—	No mapping to Cyber Essentials in our data.
5.3.5	Users cannot disable or alter anti-malware	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Requirement 6: Develop and maintain secure systems and software · 8
6.1.1	Secure systems and software policies documented	No mapping in our data	—	No mapping to Cyber Essentials in our data.
6.1.2	Roles for secure systems and software assigned	No mapping in our data	—	No mapping to Cyber Essentials in our data.
6.5.1	Production changes follow change control procedures	No mapping in our data	—	No mapping to Cyber Essentials in our data.
6.5.2	PCI DSS requirements re-confirmed after significant changes	No mapping in our data	—	No mapping to Cyber Essentials in our data.
6.5.3	Pre-production environments separated from production	No mapping in our data	—	No mapping to Cyber Essentials in our data.
6.5.4	Duties separated between production and pre-production	No mapping in our data	—	No mapping to Cyber Essentials in our data.
6.5.5	Live PANs not used in pre-production	No mapping in our data	—	No mapping to Cyber Essentials in our data.
6.5.6	Test data and accounts removed before go-live	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Requirement 7: Restrict access to system components and cardholder data by business need to know · 7
7.1.2	Roles for access restriction assigned	No mapping in our data	—	No mapping to Cyber Essentials in our data.
7.2.3	Privileges approved by authorised personnel	No mapping in our data	—	No mapping to Cyber Essentials in our data.
7.2.5	System and application accounts least privilege	No mapping in our data	—	No mapping to Cyber Essentials in our data.
7.2.6	Access to cardholder data repositories restricted	No mapping in our data	—	No mapping to Cyber Essentials in our data.
7.3.1	Access control system restricts access by need	No mapping in our data	—	No mapping to Cyber Essentials in our data.
7.3.2	Access control system enforces assigned permissions	No mapping in our data	—	No mapping to Cyber Essentials in our data.
7.3.3	Access control system set to deny by default	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Requirement 8: Identify users and authenticate access to system components · 12
8.1.2	Roles for identification and authentication assigned	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8.2.2	Shared or generic accounts only by documented exception	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8.2.3	Service providers use unique credentials per customer	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8.2.4	User ID changes authorised and controlled	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8.2.5	Access revoked immediately on termination	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8.2.7	Third-party remote access accounts enabled only when needed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8.3.2	Authentication factors unreadable in transit and storage	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8.3.3	Identity verified before changing authentication factors	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8.3.4	Account lockout after repeated failed attempts	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8.3.5	First-use and reset passwords unique and changed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8.3.11	Tokens, smart cards and certificates assigned to individuals	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8.6.1	Interactive use of system accounts managed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Requirement 9: Restrict physical access to cardholder data · 24
9.1.1	Physical security policies documented and kept current	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.1.2	Roles for physical security assigned	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.2.1	Facility entry controls restrict CDE access	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.2.1.1	Access to sensitive areas monitored by camera or access control	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.2.2	Publicly accessible network jacks restricted	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.2.3	Physical access to network hardware restricted	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.3.1	Personnel physical access authorised and managed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.3.1.1	Sensitive-area access authorised and revoked promptly	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.3.2	Visitor access authorised, escorted and identifiable	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.3.3	Visitor badges returned or deactivated	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.3.4	Visitor log maintained and retained	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.4.1	Media with cardholder data physically secured	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.4.1.1	Offline backup media stored securely	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.4.1.2	Security of offline backup location reviewed annually	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.4.2	Media classified by data sensitivity	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.4.3	Media sent off site tracked and secured	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.4.4	Management approves media moved off site	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.4.5	Inventory logs of electronic media kept	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.4.5.1	Electronic media inventories at least annually	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.4.6	Hard-copy media destroyed when no longer needed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.4.7	Electronic media destroyed or made unrecoverable	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.5.1	Card-reading (POI) devices protected from tampering	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.5.1.2.1	Inspection frequency set by targeted risk analysis	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9.5.1.3	Staff trained to spot POI tampering	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Requirement 10: Log and monitor all access to system components and cardholder data · 24
10.1.1	Logging and monitoring policies documented	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.1.2	Roles for logging and monitoring assigned	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.2.1.1	Logs capture user access to cardholder data	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.2.1.2	Logs capture administrative actions	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.2.1.3	Logs capture access to audit logs	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.2.1.4	Logs capture invalid access attempts	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.2.1.5	Logs capture credential and privilege changes	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.2.1.6	Logs capture starting, stopping or pausing logging	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.2.1.7	Logs capture system-level object changes	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.2.2	Log entries record who, what, when, where and outcome	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.3.1	Read access to logs limited to need	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.3.2	Logs protected from modification	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.3.3	Logs promptly backed up to a central server	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.4.1	Security event and critical logs reviewed daily	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.4.2	Other logs reviewed periodically	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.4.2.1	Review frequency set by targeted risk analysis	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.4.3	Exceptions and anomalies addressed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.5.1	Audit logs retained 12 months, three immediately available	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.6.1	System clocks synchronised	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.6.2	Time configuration correct and consistent	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.6.3	Time settings protected from change	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.7.1	Service providers detect security control failures	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.7.2	Critical security control failures detected and reported	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.7.3	Security control failures responded to promptly	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Requirement 11: Test security of systems and networks regularly · 16
11.1.1	Security testing policies documented and kept current	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.1.2	Roles for security testing assigned	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.2.2	Inventory of authorised wireless access points	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.3.1.1	Lower-ranked vulnerabilities handled by risk analysis	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.3.1.2	Internal scans use authenticated scanning	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.3.1.3	Internal scans after significant changes	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.3.2.1	External scans after significant changes	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.4.1	Penetration testing methodology defined	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.4.2	Internal penetration test at least annually	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.4.3	External penetration test at least annually	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.4.5	Segmentation controls tested at least annually	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.4.6	Service providers test segmentation every six months	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.4.7	Multi-tenant providers support customer penetration tests	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.5.1	Intrusion detection or prevention on network traffic	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.5.1.1	Service providers detect covert malware communication	No mapping in our data	—	No mapping to Cyber Essentials in our data.
11.5.2	Change-detection on critical files	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Requirement 12: Support information security with organizational policies and programs · 29
12.1.1	Information security policy established and published	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.1.2	Security policy reviewed at least annually	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.1.4	Executive responsibility for information security assigned	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.2.1	Acceptable use policies for end-user technologies	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.3.1	Targeted risk analysis for flexible-frequency requirements	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.3.2	Targeted risk analysis for customised approach	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.3.3	Cipher suites and protocols reviewed annually	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.4.1	Service providers: executive responsibility for PCI DSS compliance	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.4.2	Service providers: quarterly reviews of operational tasks	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.4.2.1	Service providers: quarterly review results documented	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.5.2.1	Service providers confirm scope every six months	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.5.3	Service providers review scope after organisational change	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.6.1	Formal security awareness programme	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.6.2	Awareness programme reviewed annually	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.6.3	Awareness training on hire and at least annually	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.6.3.1	Training covers phishing and social engineering	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.6.3.2	Training covers acceptable use of technology	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.7.1	Personnel screened before hire	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.8.2	Written agreements with service providers	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.9.1	Service providers acknowledge responsibilities to customers	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.9.2	Service providers support customer compliance requests	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.10.1	Incident response plan ready to activate	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.10.2	Incident response plan reviewed and tested annually	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.10.3	Incident response staff available around the clock	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.10.4	Incident response staff trained	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.10.4.1	Training frequency set by targeted risk analysis	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.10.5	Plan covers alerts from security monitoring	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.10.6	Plan updated from lessons learned and industry changes	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.10.7	Procedures for PAN found where it shouldn't be	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Appendix A: additional requirements · 10
A1.1.1	Multi-tenant providers: separate provider and customer environments	No mapping in our data	—	No mapping to Cyber Essentials in our data.
A1.1.2	Multi-tenant providers: customers confined to their own environment	No mapping in our data	—	No mapping to Cyber Essentials in our data.
A1.1.3	Multi-tenant providers: customers reach only their own data	No mapping in our data	—	No mapping to Cyber Essentials in our data.
A1.1.4	Multi-tenant providers: separation tested every six months	No mapping in our data	—	No mapping to Cyber Essentials in our data.
A1.2.1	Multi-tenant providers: audit logging for each customer	No mapping in our data	—	No mapping to Cyber Essentials in our data.
A1.2.2	Multi-tenant providers: support customer forensic investigations	No mapping in our data	—	No mapping to Cyber Essentials in our data.
A1.2.3	Multi-tenant providers: report suspected incidents to customers	No mapping in our data	—	No mapping to Cyber Essentials in our data.
A2.1.1	POI terminals using SSL or early TLS not exploitable	No mapping in our data	—	No mapping to Cyber Essentials in our data.
A2.1.2	Service providers: migration plan off SSL and early TLS	No mapping in our data	—	No mapping to Cyber Essentials in our data.
A2.1.3	Service providers offer a secure connection option	No mapping in our data	—	No mapping to Cyber Essentials in our data.

Check these: only loosely related (a shared CSF outcome, not a mapping) (47)

PCI DSS	Requirement	Match	Cyber Essentials	Evidence
Requirement 1: Install and maintain network security controls · 1
1.2.4	Accurate account-data flow diagram maintained	Loosely related	CE 1 CE 4	Only shares CSF ID.AM-03, PR.IR-01: related, not a mapping
Requirement 2: Apply secure configurations to all system components · 1
2.3.1	Wireless vendor defaults changed	Loosely related	CE 4	Only shares CSF PR.AA-03: related, not a mapping
Requirement 3: Protect stored account data · 6
3.5.1.3	Disk encryption access managed separately from OS access	Loosely related	CE 4	Only shares CSF PR.AA-03: related, not a mapping
3.6.1	Procedures protect keys that secure stored account data	Loosely related	CE 4	Only shares CSF PR.AA-01: related, not a mapping
3.6.1.1	Service providers document their cryptographic architecture	Loosely related	CE 4	Only shares CSF PR.AA-01: related, not a mapping
3.6.1.2	Secret and private keys stored in approved forms	Loosely related	CE 4	Only shares CSF PR.AA-01: related, not a mapping
3.6.1.3	Cleartext key components accessible to fewest custodians	Loosely related	CE 4	Only shares CSF PR.AA-01: related, not a mapping
3.6.1.4	Keys stored in the fewest possible locations	Loosely related	CE 4	Only shares CSF PR.AA-01: related, not a mapping
Requirement 5: Protect all systems and networks from malicious software · 3
5.2.3	Systems without anti-malware periodically re-evaluated	Loosely related	CE 1 CE 4	Only shares CSF PR.IR-01: related, not a mapping
5.2.3.1	Re-evaluation frequency set by targeted risk analysis	Loosely related	CE 1 CE 4	Only shares CSF PR.IR-01: related, not a mapping
5.4.1	Mechanisms to detect and protect against phishing	Loosely related	CE 5	Only shares CSF DE.CM-09: related, not a mapping
Requirement 6: Develop and maintain secure systems and software · 8
6.2.1	Bespoke and custom software developed securely	Loosely related	CE 3	Only shares CSF ID.AM-08: related, not a mapping
6.2.2	Developers trained in secure software development	Loosely related	CE 3	Only shares CSF ID.AM-08: related, not a mapping
6.2.3	Custom code reviewed before release	Loosely related	CE 3	Only shares CSF ID.AM-08: related, not a mapping
6.2.3.1	Manual code reviews approved by someone else	Loosely related	CE 3	Only shares CSF ID.AM-08: related, not a mapping
6.2.4	Coding techniques prevent common software attacks	Loosely related	CE 4 CE 1 CE 3	Only shares CSF PR.AA-03, PR.IR-01, ID.AM-08: related, not a mapping
6.4.1	Public web applications protected against attacks	Loosely related	CE 1 CE 4	Only shares CSF PR.IR-01: related, not a mapping
6.4.2	Automated solution blocks attacks on public web apps	Loosely related	CE 1 CE 4	Only shares CSF PR.IR-01: related, not a mapping
6.4.3	Payment page scripts authorised and integrity-checked	Loosely related	CE 5 CE 1 CE 3+1	Only shares CSF DE.CM-09, PR.PS-05, PR.IR-01, ID.AM-02: related, not a mapping
Requirement 7: Restrict access to system components and cardholder data by business need to know · 2
7.1.1	Access restriction policies documented and kept current	Loosely related	CE 2 CE 4	Only shares CSF PR.AA-05: related, not a mapping
7.2.5.1	System and application account access periodically reviewed	Loosely related	CE 2 CE 4	Only shares CSF PR.AA-05: related, not a mapping
Requirement 8: Identify users and authenticate access to system components · 12
8.1.1	Identification and authentication policies documented	Loosely related	CE 2 CE 4	Only shares CSF PR.AA-05: related, not a mapping
8.2.6	Inactive user accounts disabled within 90 days	Loosely related	CE 2 CE 4	Only shares CSF PR.AA-05: related, not a mapping
8.2.8	Re-authentication after 15 minutes idle	Loosely related	CE 4	Only shares CSF PR.AA-03: related, not a mapping
8.3.1	User and admin access requires an authentication factor	Loosely related	CE 4	Only shares CSF PR.AA-03: related, not a mapping
8.3.6	Minimum password length and complexity	Loosely related	CE 4	Only shares CSF PR.AA-03: related, not a mapping
8.3.7	Recent passwords cannot be reused	Loosely related	CE 4	Only shares CSF PR.AA-03: related, not a mapping
8.3.8	Authentication guidance communicated to users	Loosely related	CE 4	Only shares CSF PR.AA-03: related, not a mapping
8.3.9	Password-only access: change every 90 days or analyse risk	Loosely related	CE 4	Only shares CSF PR.AA-03: related, not a mapping
8.3.10	Service providers give customers password guidance	Loosely related	CE 4	Only shares CSF PR.AA-03: related, not a mapping
8.3.10.1	Service provider customer passwords: rotation or analysis	Loosely related	CE 4	Only shares CSF PR.AA-03: related, not a mapping
8.6.2	No hard-coded passwords for system accounts	Loosely related	CE 4	Only shares CSF PR.AA-01: related, not a mapping
8.6.3	System account passwords protected and changed	Loosely related	CE 4	Only shares CSF PR.AA-01: related, not a mapping
Requirement 9: Restrict physical access to cardholder data · 3
9.2.4	Consoles in sensitive areas locked when unattended	Loosely related	CE 4	Only shares CSF PR.AA-03: related, not a mapping
9.5.1.1	Inventory of POI devices kept	Loosely related	CE 3 CE 4	Only shares CSF ID.AM-01, PR.AA-01: related, not a mapping
9.5.1.2	POI devices inspected for tampering	Loosely related	CE 3	Only shares CSF ID.AM-01: related, not a mapping
Requirement 10: Log and monitor all access to system components and cardholder data · 3
10.2.1	Audit logs enabled and active	Loosely related	CE 1 CE 4	Only shares CSF PR.IR-01: related, not a mapping
10.3.4	File-integrity monitoring on logs	Loosely related	CE 5	Only shares CSF DE.CM-09: related, not a mapping
10.4.1.1	Automated mechanisms for log review	Loosely related	CE 5	Only shares CSF DE.CM-09: related, not a mapping
Requirement 11: Test security of systems and networks regularly · 3
11.2.1	Wireless access points detected and unauthorised ones handled	Loosely related	CE 1 CE 4	Only shares CSF PR.IR-01: related, not a mapping
11.4.4	Penetration test findings corrected and retested	Loosely related	CE 3	Only shares CSF ID.RA-01: related, not a mapping
11.6.1	Payment page changes and tampering detected	Loosely related	CE 3	Only shares CSF ID.AM-08: related, not a mapping
Requirement 12: Support information security with organizational policies and programs · 5
12.1.3	Security roles and responsibilities defined	Loosely related	CE 2 CE 4	Only shares CSF PR.AA-05: related, not a mapping
12.3.4	Hardware and software technologies reviewed annually	Loosely related	CE 3	Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping
12.5.2	PCI DSS scope confirmed annually and on change	Loosely related	CE 1	Only shares CSF ID.AM-03: related, not a mapping
12.8.3	Due diligence before engaging service providers	Loosely related	CE 3 CE 4	Only shares CSF ID.AM-04: related, not a mapping
12.8.4	Service provider compliance monitored annually	Loosely related	CE 3 CE 4	Only shares CSF ID.AM-04: related, not a mapping

Mapped (25)

PCI DSS	Requirement	Match	Cyber Essentials	Evidence
Requirement 1: Install and maintain network security controls · 4
1.2.1	Configuration standards for network security controls	Editorial	CE 1	Same topic: Firewall / Net Seg (editorial pick)
1.2.3	Accurate network diagram maintained	Editorial	CE 1	Same topic: Firewall / Net Seg (editorial pick)
1.3.1	Inbound traffic to the CDE restricted	Editorial	CE 1	Same topic: Firewall / Net Seg (editorial pick)
1.4.1	Network controls between trusted and untrusted networks	Editorial	CE 1	Same topic: Firewall / Net Seg (editorial pick)
Requirement 2: Apply secure configurations to all system components · 2
2.2.1	System configuration standards developed and maintained	Editorial	CE 2	Same topic: Secure Config (editorial pick)
2.2.2	Vendor default accounts managed or removed	Editorial	CE 2	Same topic: Secure Config (editorial pick)
Requirement 5: Protect all systems and networks from malicious software · 3
5.2.1	Anti-malware deployed on system components	Editorial	CE 5	Same topic: Endpoint Protection (editorial pick)
5.2.2	Anti-malware detects, removes or contains known malware	Editorial	CE 5	Same topic: Endpoint Protection (editorial pick)
5.3.2	Periodic scans or continuous behavioural analysis	Editorial	CE 5	Same topic: Endpoint Protection (editorial pick)
Requirement 6: Develop and maintain secure systems and software · 3
6.3.1	Vulnerabilities identified and risk-ranked	Editorial	CE 3	Same topic: Vulnerability Mgmt, Patch Management (editorial pick)
6.3.2	Inventory of custom software and its components	Editorial	CE 3	Same topic: Asset Management (editorial pick)
6.3.3	Security patches installed promptly	Editorial	CE 3	Same topic: Patch Management (editorial pick)
Requirement 7: Restrict access to system components and cardholder data by business need to know · 3
7.2.1	Access control model defined	Editorial	CE 4	Same topic: Access Control (editorial pick)
7.2.2	Access assigned by job function and least privilege	Editorial	CE 4	Same topic: Access Control, Privileged Access (editorial pick)
7.2.4	User accounts and privileges reviewed every six months	Editorial	CE 4	Same topic: Access Control (editorial pick)
Requirement 8: Identify users and authenticate access to system components · 5
8.2.1	Every user has a unique ID	Editorial	CE 4	Same topic: Access Control (editorial pick)
8.4.1	MFA for non-console administrative access to the CDE	Editorial	CE 4	Same topic: Multi-Factor Auth (editorial pick)
8.4.2	MFA for all access into the CDE	Editorial	CE 4	Same topic: Multi-Factor Auth (editorial pick)
8.4.3	MFA for remote network access	Editorial	CE 4	Same topic: Multi-Factor Auth (editorial pick)
8.5.1	MFA systems configured to resist misuse	Editorial	CE 4	Same topic: Multi-Factor Auth (editorial pick)
Requirement 11: Test security of systems and networks regularly · 2
11.3.1	Internal vulnerability scans every three months	Editorial	CE 3	Same topic: Vulnerability Mgmt (editorial pick)
11.3.2	External ASV scans every three months	Editorial	CE 3	Same topic: Vulnerability Mgmt (editorial pick)
Requirement 12: Support information security with organizational policies and programs · 3
12.5.1	Inventory of in-scope system components	Editorial	CE 3	Same topic: Asset Management (editorial pick)
12.8.1	List of third-party service providers kept	Editorial	CE 4	Same topic: Cloud Security (editorial pick)
12.8.5	Responsibilities split with each provider documented	Editorial	CE 4	Same topic: Cloud Security (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.

PCI DSS vs Cyber Essentials

Have PCI DSS → need Cyber Essentials

Have Cyber Essentials → need PCI DSS

By topic