Comparison

PCI DSS vs DORA

PCI DSS v4.0.1 · DORA (Regulation (EU) 2022/2554) · data 2026-10-27

Requirement-level comparison of PCI DSS v4.0.1 and DORA (Regulation (EU) 2022/2554), in both directions, derived from published crosswalks and ControlMapping's curated topics.

Have PCI DSS → need DORA

22 reqs

20 mapped · · 1 no mapping Open in gap view →

Of 22 DORA (Regulation (EU) 2022/2554) requirements, 20 map to something in PCI DSS, 1 are only loosely related, and 1 have no mapping in our data.

DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.

Likely new work: DORA requirements with no mapping to PCI DSS (1)

DORA	Requirement	Match	PCI DSS	Evidence
Chapter II: ICT risk management · 1
Art.7	ICT systems, protocols and tools	No mapping in our data	—	No mapping to PCI DSS in our data.

Check these: only loosely related (a shared CSF outcome, not a mapping) (1)

DORA	Requirement	Match	PCI DSS	Evidence
Chapter II: ICT risk management · 1
Art.14	Communication	Loosely related	12.8.2 12.8.4 12.10.1+1	Only shares CSF RS.CO-03: related, not a mapping

Mapped (20)

DORA	Requirement	Match	PCI DSS	Evidence
Chapter II: ICT risk management · 9
Art.5	Governance and organisation	Editorial	12.3.1 12.4.2 12.6.3	Same topic: Risk Management, Compliance, Awareness & Training (editorial pick)
Art.6	ICT risk management framework	Editorial	12.3.1 9.2.1 9.2.1.1+6	Same topic: Risk Management, Physical Security (editorial pick)
Art.8	Identification	Editorial	6.3.2 9.4.2 12.5.1+3	Same topic: Asset Management, Data Classification (editorial pick)
Art.9	Protection and prevention	Editorial	10.4.1 3.2.1 3.3.1+22	Same topic: Cont. Monitoring, Data Protection (editorial pick)
Art.10	Detection	Editorial	10.4.1.1 11.5.1 10.3.2+2	Same topic: Anomaly Detection, Intrusion Detection, Logging & Audit (editorial pick)
Art.11	Response and recovery	Editorial	12.10.1 12.10.3 12.10.4	Same topic: Business Continuity, Incident Response (editorial pick)
Art.12	Backup policies and procedures, restoration and recovery procedures and methods	Editorial	9.4.1.1	Same topic: Backup & Recovery (editorial pick)
Art.13	Learning and evolving	Editorial	6.3.1 10.3.2 12.10.6+2	Same topic: Threat Intelligence, Forensics, Lessons Learned (editorial pick)
Art.16	Simplified ICT risk management framework	Editorial	12.3.1	Same topic: Risk Management (editorial pick)
Chapter III: ICT-related incidents · 3
Art.17	ICT-related incident management process	Editorial	12.10.1 12.10.2 12.10.3+2	Same topic: Incident Response (editorial pick)
Art.18	Classification of ICT-related incidents and cyber threats	Editorial	12.10.1 12.10.2 12.10.3+1	Same topic: Incident Response, Reporting (editorial pick)
Art.19	Reporting of major ICT-related incidents and voluntary notification of significant cyber threats	Editorial	12.10.1	Same topic: Reporting (editorial pick)
Chapter IV: Resilience testing · 4
Art.24	General requirements for the performance of digital operational resilience testing	Editorial	12.3.1	Same topic: Risk Management (editorial pick)
Art.25	Testing of ICT tools and systems	Editorial	6.3.1 11.3.1 11.3.2	Same topic: Vulnerability Mgmt (editorial pick)
Art.26	Advanced testing of ICT tools, systems and processes based on TLPT	Editorial	6.3.1 11.3.1 11.3.2	Same topic: Vulnerability Mgmt (editorial pick)
Art.27	Requirements for testers for the carrying out of TLPT	Editorial	6.3.1 11.3.1 11.3.2	Same topic: Vulnerability Mgmt (editorial pick)
Chapter V: ICT third-party risk · 3
Art.28	General principles	Editorial	6.3.2 12.8.1	Same topic: Supply Chain Risk (editorial pick)
Art.29	Preliminary assessment of ICT concentration risk at entity level	Editorial	6.3.2 12.8.1	Same topic: Supply Chain Risk (editorial pick)
Art.30	Key contractual provisions	Editorial	12.8.1 12.8.2 12.8.3+2	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick)
Chapter VI: Information sharing · 1
Art.45	Information-sharing arrangements on cyber threat information and intelligence	Editorial	6.3.1	Same topic: Threat Intelligence (editorial pick)

Have DORA → need PCI DSS

260 reqs

62 mapped · · 111 no mapping Open in gap view →

Of 260 PCI DSS v4.0.1 requirements, 62 map to something in DORA, 87 are only loosely related, and 111 have no mapping in our data.

Likely new work: PCI DSS requirements with no mapping to DORA (111)

PCI DSS	Requirement	Match	DORA	Evidence
Requirement 1: Install and maintain network security controls · 12
1.2.2	Network connection changes go through change control	No mapping in our data	—	No mapping to DORA in our data.
1.2.5	Allowed services, protocols and ports approved	No mapping in our data	—	No mapping to DORA in our data.
1.2.6	Security features defined for insecure services	No mapping in our data	—	No mapping to DORA in our data.
1.2.7	Network security control rules reviewed every six months	No mapping in our data	—	No mapping to DORA in our data.
1.2.8	Network security control configuration files secured	No mapping in our data	—	No mapping to DORA in our data.
1.3.2	Outbound traffic from the CDE restricted	No mapping in our data	—	No mapping to DORA in our data.
1.3.3	Network controls between wireless networks and the CDE	No mapping in our data	—	No mapping to DORA in our data.
1.4.2	Inbound traffic from untrusted networks restricted	No mapping in our data	—	No mapping to DORA in our data.
1.4.3	Anti-spoofing measures in place	No mapping in our data	—	No mapping to DORA in our data.
1.4.4	Stored cardholder data not reachable from untrusted networks	No mapping in our data	—	No mapping to DORA in our data.
1.4.5	Internal IP addresses and routing not disclosed	No mapping in our data	—	No mapping to DORA in our data.
1.5.1	Controls on devices connecting to untrusted networks and the CDE	No mapping in our data	—	No mapping to DORA in our data.
Requirement 2: Apply secure configurations to all system components · 6
2.2.3	Functions with different security levels kept apart	No mapping in our data	—	No mapping to DORA in our data.
2.2.4	Only necessary services and functions enabled	No mapping in our data	—	No mapping to DORA in our data.
2.2.5	Insecure services justified and secured	No mapping in our data	—	No mapping to DORA in our data.
2.2.6	System security parameters set to prevent misuse	No mapping in our data	—	No mapping to DORA in our data.
2.2.7	Non-console administrative access encrypted	No mapping in our data	—	No mapping to DORA in our data.
2.3.2	Wireless keys changed when key holders leave	No mapping in our data	—	No mapping to DORA in our data.
Requirement 3: Protect stored account data · 14
3.3.1.1	Full track data not kept after authorisation	No mapping in our data	—	No mapping to DORA in our data.
3.3.1.2	Card verification code not kept after authorisation	No mapping in our data	—	No mapping to DORA in our data.
3.3.1.3	PIN and PIN block not kept after authorisation	No mapping in our data	—	No mapping to DORA in our data.
3.3.2	Sensitive authentication data encrypted before authorisation	No mapping in our data	—	No mapping to DORA in our data.
3.3.3	Issuer storage of sensitive authentication data limited and protected	No mapping in our data	—	No mapping to DORA in our data.
3.5.1.1	Hashes of PAN are keyed cryptographic hashes	No mapping in our data	—	No mapping to DORA in our data.
3.5.1.2	Disk-level encryption used only where it suffices	No mapping in our data	—	No mapping to DORA in our data.
3.7.2	Key management: secure key distribution	No mapping in our data	—	No mapping to DORA in our data.
3.7.3	Key management: secure key storage	No mapping in our data	—	No mapping to DORA in our data.
3.7.5	Key management: retiring weakened or compromised keys	No mapping in our data	—	No mapping to DORA in our data.
3.7.6	Key management: split knowledge and dual control	No mapping in our data	—	No mapping to DORA in our data.
3.7.7	Key management: preventing unauthorised key substitution	No mapping in our data	—	No mapping to DORA in our data.
3.7.8	Key custodians formally acknowledge their responsibilities	No mapping in our data	—	No mapping to DORA in our data.
3.7.9	Service providers give customers key-handling guidance	No mapping in our data	—	No mapping to DORA in our data.
Requirement 4: Protect cardholder data with strong cryptography during transmission · 2
4.2.1.2	Strong cryptography on wireless networks carrying PAN	No mapping in our data	—	No mapping to DORA in our data.
4.2.2	PAN secured when sent by end-user messaging	No mapping in our data	—	No mapping to DORA in our data.
Requirement 5: Protect all systems and networks from malicious software · 4
5.3.1	Anti-malware kept up to date	No mapping in our data	—	No mapping to DORA in our data.
5.3.3	Removable media scanned or analysed	No mapping in our data	—	No mapping to DORA in our data.
5.3.4	Anti-malware audit logs enabled and retained	No mapping in our data	—	No mapping to DORA in our data.
5.3.5	Users cannot disable or alter anti-malware	No mapping in our data	—	No mapping to DORA in our data.
Requirement 6: Develop and maintain secure systems and software · 6
6.5.1	Production changes follow change control procedures	No mapping in our data	—	No mapping to DORA in our data.
6.5.2	PCI DSS requirements re-confirmed after significant changes	No mapping in our data	—	No mapping to DORA in our data.
6.5.3	Pre-production environments separated from production	No mapping in our data	—	No mapping to DORA in our data.
6.5.4	Duties separated between production and pre-production	No mapping in our data	—	No mapping to DORA in our data.
6.5.5	Live PANs not used in pre-production	No mapping in our data	—	No mapping to DORA in our data.
6.5.6	Test data and accounts removed before go-live	No mapping in our data	—	No mapping to DORA in our data.
Requirement 7: Restrict access to system components and cardholder data by business need to know · 6
7.2.3	Privileges approved by authorised personnel	No mapping in our data	—	No mapping to DORA in our data.
7.2.5	System and application accounts least privilege	No mapping in our data	—	No mapping to DORA in our data.
7.2.6	Access to cardholder data repositories restricted	No mapping in our data	—	No mapping to DORA in our data.
7.3.1	Access control system restricts access by need	No mapping in our data	—	No mapping to DORA in our data.
7.3.2	Access control system enforces assigned permissions	No mapping in our data	—	No mapping to DORA in our data.
7.3.3	Access control system set to deny by default	No mapping in our data	—	No mapping to DORA in our data.
Requirement 8: Identify users and authenticate access to system components · 9
8.2.3	Service providers use unique credentials per customer	No mapping in our data	—	No mapping to DORA in our data.
8.2.4	User ID changes authorised and controlled	No mapping in our data	—	No mapping to DORA in our data.
8.2.7	Third-party remote access accounts enabled only when needed	No mapping in our data	—	No mapping to DORA in our data.
8.3.2	Authentication factors unreadable in transit and storage	No mapping in our data	—	No mapping to DORA in our data.
8.3.3	Identity verified before changing authentication factors	No mapping in our data	—	No mapping to DORA in our data.
8.3.4	Account lockout after repeated failed attempts	No mapping in our data	—	No mapping to DORA in our data.
8.3.5	First-use and reset passwords unique and changed	No mapping in our data	—	No mapping to DORA in our data.
8.3.11	Tokens, smart cards and certificates assigned to individuals	No mapping in our data	—	No mapping to DORA in our data.
8.6.1	Interactive use of system accounts managed	No mapping in our data	—	No mapping to DORA in our data.
Requirement 9: Restrict physical access to cardholder data · 10
9.2.2	Publicly accessible network jacks restricted	No mapping in our data	—	No mapping to DORA in our data.
9.3.3	Visitor badges returned or deactivated	No mapping in our data	—	No mapping to DORA in our data.
9.3.4	Visitor log maintained and retained	No mapping in our data	—	No mapping to DORA in our data.
9.4.1	Media with cardholder data physically secured	No mapping in our data	—	No mapping to DORA in our data.
9.4.3	Media sent off site tracked and secured	No mapping in our data	—	No mapping to DORA in our data.
9.4.4	Management approves media moved off site	No mapping in our data	—	No mapping to DORA in our data.
9.4.5	Inventory logs of electronic media kept	No mapping in our data	—	No mapping to DORA in our data.
9.4.5.1	Electronic media inventories at least annually	No mapping in our data	—	No mapping to DORA in our data.
9.5.1	Card-reading (POI) devices protected from tampering	No mapping in our data	—	No mapping to DORA in our data.
9.5.1.3	Staff trained to spot POI tampering	No mapping in our data	—	No mapping to DORA in our data.
Requirement 10: Log and monitor all access to system components and cardholder data · 12
10.2.1.1	Logs capture user access to cardholder data	No mapping in our data	—	No mapping to DORA in our data.
10.2.1.2	Logs capture administrative actions	No mapping in our data	—	No mapping to DORA in our data.
10.2.1.3	Logs capture access to audit logs	No mapping in our data	—	No mapping to DORA in our data.
10.2.1.4	Logs capture invalid access attempts	No mapping in our data	—	No mapping to DORA in our data.
10.2.1.5	Logs capture credential and privilege changes	No mapping in our data	—	No mapping to DORA in our data.
10.2.1.6	Logs capture starting, stopping or pausing logging	No mapping in our data	—	No mapping to DORA in our data.
10.2.1.7	Logs capture system-level object changes	No mapping in our data	—	No mapping to DORA in our data.
10.4.2	Other logs reviewed periodically	No mapping in our data	—	No mapping to DORA in our data.
10.4.3	Exceptions and anomalies addressed	No mapping in our data	—	No mapping to DORA in our data.
10.6.2	Time configuration correct and consistent	No mapping in our data	—	No mapping to DORA in our data.
10.7.1	Service providers detect security control failures	No mapping in our data	—	No mapping to DORA in our data.
10.7.3	Security control failures responded to promptly	No mapping in our data	—	No mapping to DORA in our data.
Requirement 11: Test security of systems and networks regularly · 12
11.2.2	Inventory of authorised wireless access points	No mapping in our data	—	No mapping to DORA in our data.
11.3.1.2	Internal scans use authenticated scanning	No mapping in our data	—	No mapping to DORA in our data.
11.3.1.3	Internal scans after significant changes	No mapping in our data	—	No mapping to DORA in our data.
11.3.2.1	External scans after significant changes	No mapping in our data	—	No mapping to DORA in our data.
11.4.1	Penetration testing methodology defined	No mapping in our data	—	No mapping to DORA in our data.
11.4.2	Internal penetration test at least annually	No mapping in our data	—	No mapping to DORA in our data.
11.4.3	External penetration test at least annually	No mapping in our data	—	No mapping to DORA in our data.
11.4.5	Segmentation controls tested at least annually	No mapping in our data	—	No mapping to DORA in our data.
11.4.6	Service providers test segmentation every six months	No mapping in our data	—	No mapping to DORA in our data.
11.4.7	Multi-tenant providers support customer penetration tests	No mapping in our data	—	No mapping to DORA in our data.
11.5.1.1	Service providers detect covert malware communication	No mapping in our data	—	No mapping to DORA in our data.
11.5.2	Change-detection on critical files	No mapping in our data	—	No mapping to DORA in our data.
Requirement 12: Support information security with organizational policies and programs · 8
12.2.1	Acceptable use policies for end-user technologies	No mapping in our data	—	No mapping to DORA in our data.
12.4.1	Service providers: executive responsibility for PCI DSS compliance	No mapping in our data	—	No mapping to DORA in our data.
12.4.2.1	Service providers: quarterly review results documented	No mapping in our data	—	No mapping to DORA in our data.
12.5.2.1	Service providers confirm scope every six months	No mapping in our data	—	No mapping to DORA in our data.
12.6.2	Awareness programme reviewed annually	No mapping in our data	—	No mapping to DORA in our data.
12.6.3.1	Training covers phishing and social engineering	No mapping in our data	—	No mapping to DORA in our data.
12.6.3.2	Training covers acceptable use of technology	No mapping in our data	—	No mapping to DORA in our data.
12.10.5	Plan covers alerts from security monitoring	No mapping in our data	—	No mapping to DORA in our data.
Appendix A: additional requirements · 10
A1.1.1	Multi-tenant providers: separate provider and customer environments	No mapping in our data	—	No mapping to DORA in our data.
A1.1.2	Multi-tenant providers: customers confined to their own environment	No mapping in our data	—	No mapping to DORA in our data.
A1.1.3	Multi-tenant providers: customers reach only their own data	No mapping in our data	—	No mapping to DORA in our data.
A1.1.4	Multi-tenant providers: separation tested every six months	No mapping in our data	—	No mapping to DORA in our data.
A1.2.1	Multi-tenant providers: audit logging for each customer	No mapping in our data	—	No mapping to DORA in our data.
A1.2.2	Multi-tenant providers: support customer forensic investigations	No mapping in our data	—	No mapping to DORA in our data.
A1.2.3	Multi-tenant providers: report suspected incidents to customers	No mapping in our data	—	No mapping to DORA in our data.
A2.1.1	POI terminals using SSL or early TLS not exploitable	No mapping in our data	—	No mapping to DORA in our data.
A2.1.2	Service providers: migration plan off SSL and early TLS	No mapping in our data	—	No mapping to DORA in our data.
A2.1.3	Service providers offer a secure connection option	No mapping in our data	—	No mapping to DORA in our data.

Check these: only loosely related (a shared CSF outcome, not a mapping) (87)

PCI DSS	Requirement	Match	DORA	Evidence
Requirement 1: Install and maintain network security controls · 3
1.1.1	Network security policies documented and kept current	Loosely related	Art.5(2)(b)Art.6(5)Art.9(4)(a)	Only shares CSF GV.PO-02: related, not a mapping
1.1.2	Roles for network security controls assigned	Loosely related	Art.5(2)(c)Art.5(3)Art.6(4)	Only shares CSF GV.RR-02: related, not a mapping
1.2.4	Accurate account-data flow diagram maintained	Loosely related	Art.28(8)Art.30(2)Art.28(3)+5	Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, PR.IR-01: related, not a mapping
Requirement 2: Apply secure configurations to all system components · 5
2.1.1	Secure configuration policies documented and kept current	Loosely related	Art.5(2)(b)Art.6(5)Art.9(4)(a)	Only shares CSF GV.PO-02: related, not a mapping
2.1.2	Roles for secure configuration assigned	Loosely related	Art.5(2)(c)Art.5(3)Art.6(4)	Only shares CSF GV.RR-02: related, not a mapping
2.2.1	System configuration standards developed and maintained	Loosely related	Art.11(2)(c)Art.17(3)(f)Art.28(8)+1	Only shares CSF RS.MI-02, PR.PS-01: related, not a mapping
2.2.2	Vendor default accounts managed or removed	Loosely related	Art.9(4)(d)Art.28(8)Art.30(2)	Only shares CSF PR.AA-03, PR.PS-01: related, not a mapping
2.3.1	Wireless vendor defaults changed	Loosely related	Art.9(4)(d)Art.9(2)Art.9(3)(a)+2	Only shares CSF PR.AA-03, PR.DS-02: related, not a mapping
Requirement 3: Protect stored account data · 8
3.1.1	Stored account data policies documented and kept current	Loosely related	Art.5(2)(b)Art.6(5)Art.9(4)(a)	Only shares CSF GV.PO-02: related, not a mapping
3.1.2	Roles for protecting stored account data assigned	Loosely related	Art.5(2)(c)Art.5(3)Art.6(4)	Only shares CSF GV.RR-02: related, not a mapping
3.4.2	PAN copying prevented over remote-access technologies	Loosely related	Art.9(2)Art.9(3)(c)Art.9(3)(d)+3	Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping
3.5.1.3	Disk encryption access managed separately from OS access	Loosely related	Art.9(4)(d)Art.9(2)Art.9(3)(a)+2	Only shares CSF PR.AA-03, PR.DS-01: related, not a mapping
3.6.1.1	Service providers document their cryptographic architecture	Loosely related	Art.9(2)Art.9(3)(a)Art.9(3)(c)+3	Only shares CSF PR.DS-01: related, not a mapping
3.6.1.2	Secret and private keys stored in approved forms	Loosely related	Art.9(2)Art.9(3)(a)Art.9(3)(c)+3	Only shares CSF PR.DS-01: related, not a mapping
3.6.1.3	Cleartext key components accessible to fewest custodians	Loosely related	Art.9(2)Art.9(3)(a)Art.9(3)(c)+3	Only shares CSF PR.DS-01: related, not a mapping
3.6.1.4	Keys stored in the fewest possible locations	Loosely related	Art.9(2)Art.9(3)(a)Art.9(3)(c)+3	Only shares CSF PR.DS-01: related, not a mapping
Requirement 4: Protect cardholder data with strong cryptography during transmission · 2
4.1.1	Data-in-transit policies documented and kept current	Loosely related	Art.5(2)(b)Art.6(5)Art.9(4)(a)	Only shares CSF GV.PO-02: related, not a mapping
4.1.2	Roles for protecting data in transit assigned	Loosely related	Art.5(2)(c)Art.5(3)Art.6(4)	Only shares CSF GV.RR-02: related, not a mapping
Requirement 5: Protect all systems and networks from malicious software · 9
5.1.1	Anti-malware policies documented and kept current	Loosely related	Art.5(2)(b)Art.6(5)Art.9(4)(a)	Only shares CSF GV.PO-02: related, not a mapping
5.1.2	Roles for malware protection assigned	Loosely related	Art.5(2)(c)Art.5(3)Art.6(4)	Only shares CSF GV.RR-02: related, not a mapping
5.2.1	Anti-malware deployed on system components	Loosely related	Art.9(1)Art.9(4)(b)Art.10(1)+5	Only shares CSF DE.CM-09, PR.IR-01: related, not a mapping
5.2.2	Anti-malware detects, removes or contains known malware	Loosely related	Art.11(2)(c)Art.17(3)(f)Art.9(1)+5	Only shares CSF RS.MI-01, RS.MI-02, DE.CM-09: related, not a mapping
5.2.3	Systems without anti-malware periodically re-evaluated	Loosely related	Art.9(4)(b)Art.28(8)Art.30(2)	Only shares CSF PR.IR-01: related, not a mapping
5.2.3.1	Re-evaluation frequency set by targeted risk analysis	Loosely related	Art.5(2)(a)Art.6(1)Art.6(8)+5	Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
5.3.2	Periodic scans or continuous behavioural analysis	Loosely related	Art.9(1)Art.10(1)Art.10(3)+5	Only shares CSF DE.CM-09: related, not a mapping
5.3.2.1	Scan frequency set by targeted risk analysis	Loosely related	Art.5(2)(a)Art.6(1)Art.6(8)+2	Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
5.4.1	Mechanisms to detect and protect against phishing	Loosely related	Art.9(1)Art.9(2)Art.9(3)(a)+5	Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping
Requirement 6: Develop and maintain secure systems and software · 10
6.1.1	Secure systems and software policies documented	Loosely related	Art.5(2)(b)Art.6(5)Art.9(4)(a)	Only shares CSF GV.PO-02: related, not a mapping
6.1.2	Roles for secure systems and software assigned	Loosely related	Art.5(2)(c)Art.5(3)Art.6(4)	Only shares CSF GV.RR-02: related, not a mapping
6.2.1	Bespoke and custom software developed securely	Loosely related	Art.8(1)Art.8(4)Art.8(6)	Only shares CSF ID.AM-08: related, not a mapping
6.2.2	Developers trained in secure software development	Loosely related	Art.5(2)(c)Art.5(3)Art.5(4)+5	Only shares CSF GV.RR-01, PR.AT-02: related, not a mapping
6.2.3	Custom code reviewed before release	Loosely related	Art.28(2)Art.29(1)Art.29(2)+5	Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping
6.2.3.1	Manual code reviews approved by someone else	Loosely related	Art.8(1)Art.8(4)Art.8(6)	Only shares CSF ID.AM-08: related, not a mapping
6.2.4	Coding techniques prevent common software attacks	Loosely related	Art.8(1)Art.8(4)Art.8(6)+4	Only shares CSF ID.AM-08: related, not a mapping
6.4.1	Public web applications protected against attacks	Loosely related	Art.9(4)(b)Art.28(8)Art.30(2)	Only shares CSF PR.IR-01: related, not a mapping
6.4.2	Automated solution blocks attacks on public web apps	Loosely related	Art.9(1)Art.9(4)(b)Art.10(1)+4	Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping
6.4.3	Payment page scripts authorised and integrity-checked	Loosely related	Art.28(2)Art.29(1)Art.29(2)+5	Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09, ID.RA-09: related, not a mapping
Requirement 7: Restrict access to system components and cardholder data by business need to know · 3
7.1.1	Access restriction policies documented and kept current	Loosely related	Art.5(2)(b)Art.6(5)Art.9(4)(a)+1	Only shares CSF GV.PO-02: related, not a mapping
7.1.2	Roles for access restriction assigned	Loosely related	Art.5(2)(c)Art.5(3)Art.6(4)	Only shares CSF GV.RR-02: related, not a mapping
7.2.5.1	System and application account access periodically reviewed	Loosely related	Art.5(2)(a)Art.6(1)Art.6(8)+5	Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
Requirement 8: Identify users and authenticate access to system components · 15
8.1.1	Identification and authentication policies documented	Loosely related	Art.5(2)(b)Art.6(5)Art.9(4)(a)+1	Only shares CSF GV.PO-02: related, not a mapping
8.1.2	Roles for identification and authentication assigned	Loosely related	Art.5(2)(c)Art.5(3)Art.6(4)	Only shares CSF GV.RR-02: related, not a mapping
8.2.2	Shared or generic accounts only by documented exception	Loosely related	Art.9(1)Art.10(3)	Only shares CSF DE.CM-03: related, not a mapping
8.2.5	Access revoked immediately on termination	Loosely related	Art.10(3)	Only shares CSF GV.RR-04: related, not a mapping
8.2.6	Inactive user accounts disabled within 90 days	Loosely related	Art.9(4)(c)	Only shares CSF PR.AA-05: related, not a mapping
8.2.8	Re-authentication after 15 minutes idle	Loosely related	Art.9(2)Art.9(3)(c)Art.9(3)(d)+1	Only shares CSF PR.DS-10: related, not a mapping
8.3.1	User and admin access requires an authentication factor	Loosely related	Art.9(4)(d)	Only shares CSF PR.AA-03: related, not a mapping
8.3.6	Minimum password length and complexity	Loosely related	Art.9(4)(d)	Only shares CSF PR.AA-03: related, not a mapping
8.3.7	Recent passwords cannot be reused	Loosely related	Art.9(4)(d)	Only shares CSF PR.AA-03: related, not a mapping
8.3.8	Authentication guidance communicated to users	Loosely related	Art.9(4)(d)	Only shares CSF PR.AA-03: related, not a mapping
8.3.9	Password-only access: change every 90 days or analyse risk	Loosely related	Art.9(4)(d)	Only shares CSF PR.AA-03: related, not a mapping
8.3.10	Service providers give customers password guidance	Loosely related	Art.9(4)(d)	Only shares CSF PR.AA-03: related, not a mapping
8.3.10.1	Service provider customer passwords: rotation or analysis	Loosely related	Art.9(4)(d)	Only shares CSF PR.AA-03: related, not a mapping
8.6.2	No hard-coded passwords for system accounts	Loosely related	Art.9(4)(c)	Only shares CSF PR.AA-01: related, not a mapping
8.6.3	System account passwords protected and changed	Loosely related	Art.5(2)(a)Art.6(1)Art.6(8)+3	Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
Requirement 9: Restrict physical access to cardholder data · 9
9.1.1	Physical security policies documented and kept current	Loosely related	Art.5(2)(b)Art.6(2)Art.6(5)+2	Only shares CSF GV.PO-02, PR.IR-02: related, not a mapping
9.1.2	Roles for physical security assigned	Loosely related	Art.5(2)(c)Art.5(3)Art.6(2)+2	Only shares CSF GV.RR-02, PR.IR-02: related, not a mapping
9.2.4	Consoles in sensitive areas locked when unattended	Loosely related	Art.6(2)Art.9(4)(c)Art.9(4)(d)	Only shares CSF PR.AA-06, PR.AA-03: related, not a mapping
9.4.1.2	Security of offline backup location reviewed annually	Loosely related	Art.12(1)Art.12(2)Art.12(3)+2	Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
9.4.6	Hard-copy media destroyed when no longer needed	Loosely related	Art.5(2)(f)Art.6(6)Art.6(7)+5	Only shares CSF GV.OC-03: related, not a mapping
9.4.7	Electronic media destroyed or made unrecoverable	Loosely related	Art.5(2)(f)Art.6(6)Art.6(7)+5	Only shares CSF GV.OC-03: related, not a mapping
9.5.1.1	Inventory of POI devices kept	Loosely related	Art.28(2)Art.29(1)Art.29(2)+4	Only shares CSF GV.SC-09, ID.RA-09: related, not a mapping
9.5.1.2	POI devices inspected for tampering	Loosely related	Art.6(2)Art.9(4)(c)Art.8(1)+5	Only shares CSF DE.CM-02, PR.AA-06, ID.AM-01: related, not a mapping
9.5.1.2.1	Inspection frequency set by targeted risk analysis	Loosely related	Art.5(2)(a)Art.6(1)Art.6(8)+5	Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
Requirement 10: Log and monitor all access to system components and cardholder data · 9
10.1.1	Logging and monitoring policies documented	Loosely related	Art.5(2)(b)Art.6(5)Art.9(4)(a)	Only shares CSF GV.PO-02: related, not a mapping
10.1.2	Roles for logging and monitoring assigned	Loosely related	Art.5(2)(c)Art.5(3)Art.6(4)	Only shares CSF GV.RR-02: related, not a mapping
10.2.2	Log entries record who, what, when, where and outcome	Loosely related	Art.13(2)Art.17(2)	Only shares CSF RS.AN-03, RS.AN-07: related, not a mapping
10.3.1	Read access to logs limited to need	Loosely related	Art.10(3)Art.10(2)Art.13(2)+1	Only shares CSF DE.AE-06, PR.PS-04, RS.AN-06: related, not a mapping
10.3.3	Logs promptly backed up to a central server	Loosely related	Art.10(2)Art.10(3)Art.13(2)+2	Only shares CSF DE.AE-02, DE.AE-03, DE.AE-06, PR.PS-04…: related, not a mapping
10.3.4	File-integrity monitoring on logs	Loosely related	Art.10(1)Art.10(3)Art.9(1)+3	Only shares CSF DE.AE-02, DE.CM-09, PR.PS-04: related, not a mapping
10.4.2.1	Review frequency set by targeted risk analysis	Loosely related	Art.5(2)(a)Art.6(1)Art.6(8)+5	Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
10.6.3	Time settings protected from change	Loosely related	Art.10(3)	Only shares CSF PR.PS-04: related, not a mapping
10.7.2	Critical security control failures detected and reported	Loosely related	Art.5(2)(f)Art.6(6)Art.6(7)	Only shares CSF GV.OV-03: related, not a mapping
Requirement 11: Test security of systems and networks regularly · 6
11.1.1	Security testing policies documented and kept current	Loosely related	Art.5(2)(b)Art.6(5)Art.9(4)(a)	Only shares CSF GV.PO-02: related, not a mapping
11.1.2	Roles for security testing assigned	Loosely related	Art.5(2)(c)Art.5(3)Art.6(4)	Only shares CSF GV.RR-02: related, not a mapping
11.2.1	Wireless access points detected and unauthorised ones handled	Loosely related	Art.9(1)Art.9(4)(b)Art.10(1)+4	Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping
11.3.1.1	Lower-ranked vulnerabilities handled by risk analysis	Loosely related	Art.5(2)(a)Art.6(1)Art.6(8)+5	Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
11.4.4	Penetration test findings corrected and retested	Loosely related	Art.5(2)(f)Art.6(6)Art.6(7)+5	Only shares CSF GV.OV-03: related, not a mapping
11.6.1	Payment page changes and tampering detected	Loosely related	Art.28(2)Art.29(1)Art.29(2)+5	Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping
Requirement 12: Support information security with organizational policies and programs · 8
12.3.2	Targeted risk analysis for customised approach	Loosely related	Art.5(2)(a)Art.6(1)Art.6(8)+2	Only shares CSF GV.RM-06: related, not a mapping
12.3.3	Cipher suites and protocols reviewed annually	Loosely related	Art.5(2)(a)Art.6(1)Art.6(8)+5	Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
12.3.4	Hardware and software technologies reviewed annually	Loosely related	Art.5(2)(a)Art.6(1)Art.6(8)+5	Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
12.5.3	Service providers review scope after organisational change	Loosely related	Art.5(2)(a)Art.6(1)Art.6(8)+2	Only shares CSF GV.RM-03: related, not a mapping
12.9.1	Service providers acknowledge responsibilities to customers	Loosely related	Art.28(2)Art.29(1)Art.29(2)+5	Only shares CSF GV.SC-01, GV.SC-05: related, not a mapping
12.9.2	Service providers support customer compliance requests	Loosely related	Art.28(2)Art.29(1)Art.29(2)+5	Only shares CSF GV.SC-01, GV.SC-05: related, not a mapping
12.10.4.1	Training frequency set by targeted risk analysis	Loosely related	Art.5(2)(a)Art.6(1)Art.6(8)+4	Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
12.10.7	Procedures for PAN found where it shouldn't be	Loosely related	Art.8(1)	Only shares CSF ID.AM-07: related, not a mapping

Mapped (62)

PCI DSS	Requirement	Match	DORA	Evidence
Requirement 1: Install and maintain network security controls · 4
1.2.1	Configuration standards for network security controls	Editorial	Art.9(4)(b)	Same topic: Firewall / Net Seg (editorial pick)
1.2.3	Accurate network diagram maintained	Editorial	Art.9(4)(b)	Same topic: Firewall / Net Seg (editorial pick)
1.3.1	Inbound traffic to the CDE restricted	Editorial	Art.9(4)(b)	Same topic: Firewall / Net Seg (editorial pick)
1.4.1	Network controls between trusted and untrusted networks	Editorial	Art.9(4)(b)	Same topic: Firewall / Net Seg (editorial pick)
Requirement 3: Protect stored account data · 7
3.2.1	Account data storage minimised, with retention and disposal	Editorial	Art.9(2)Art.9(3)(c)Art.9(3)(d)	Same topic: Data Protection (editorial pick)
3.3.1	Sensitive authentication data not kept after authorisation	Editorial	Art.9(2)Art.9(3)(c)Art.9(3)(d)	Same topic: Data Protection (editorial pick)
3.4.1	PAN masked when displayed	Editorial	Art.9(2)Art.9(3)(c)Art.9(3)(d)	Same topic: Data Protection (editorial pick)
3.5.1	PAN rendered unreadable wherever stored	Editorial	Art.9(3)(a)Art.9(4)(d)	Same topic: Encryption (editorial pick)
3.6.1	Procedures protect keys that secure stored account data	Editorial	Art.9(3)(a)Art.9(4)(d)	Same topic: Encryption (editorial pick)
3.7.1	Key management: strong key generation	Editorial	Art.9(3)(a)Art.9(4)(d)	Same topic: Encryption (editorial pick)
3.7.4	Key management: key changes at end of cryptoperiod	Editorial	Art.9(3)(a)Art.9(4)(d)	Same topic: Encryption (editorial pick)
Requirement 4: Protect cardholder data with strong cryptography during transmission · 2
4.2.1	Strong cryptography for PAN over open, public networks	Editorial	Art.9(3)(a)Art.9(4)(d)	Same topic: Encryption (editorial pick)
4.2.1.1	Inventory of trusted keys and certificates kept	Editorial	Art.9(3)(a)Art.9(4)(d)	Same topic: Encryption (editorial pick)
Requirement 6: Develop and maintain secure systems and software · 3
6.3.1	Vulnerabilities identified and risk-ranked	Editorial	Art.8(2)Art.9(4)(f)Art.13(1)+4	Same topic: Vulnerability Mgmt, Threat Intelligence, Patch Management (editorial pick)
6.3.2	Inventory of custom software and its components	Editorial	Art.8(1)Art.8(4)Art.8(6)+3	Same topic: Asset Management (editorial pick)
6.3.3	Security patches installed promptly	Editorial	Art.9(4)(f)	Same topic: Patch Management (editorial pick)
Requirement 7: Restrict access to system components and cardholder data by business need to know · 3
7.2.1	Access control model defined	Editorial	Art.9(4)(c)	Same topic: Access Control (editorial pick)
7.2.2	Access assigned by job function and least privilege	Editorial	Art.9(4)(c)	Same topic: Access Control, Privileged Access (editorial pick)
7.2.4	User accounts and privileges reviewed every six months	Editorial	Art.9(4)(c)	Same topic: Access Control (editorial pick)
Requirement 8: Identify users and authenticate access to system components · 5
8.2.1	Every user has a unique ID	Editorial	Art.9(4)(c)	Same topic: Access Control (editorial pick)
8.4.1	MFA for non-console administrative access to the CDE	Editorial	Art.9(4)(d)	Same topic: Multi-Factor Auth (editorial pick)
8.4.2	MFA for all access into the CDE	Editorial	Art.9(4)(d)	Same topic: Multi-Factor Auth (editorial pick)
8.4.3	MFA for remote network access	Editorial	Art.9(4)(d)	Same topic: Multi-Factor Auth (editorial pick)
8.5.1	MFA systems configured to resist misuse	Editorial	Art.9(4)(d)	Same topic: Multi-Factor Auth (editorial pick)
Requirement 9: Restrict physical access to cardholder data · 8
9.2.1	Facility entry controls restrict CDE access	Editorial	Art.6(2)Art.9(4)(c)	Same topic: Physical Security (editorial pick)
9.2.1.1	Access to sensitive areas monitored by camera or access control	Editorial	Art.6(2)Art.9(4)(c)	Same topic: Physical Security (editorial pick)
9.2.3	Physical access to network hardware restricted	Editorial	Art.6(2)Art.9(4)(c)	Same topic: Physical Security (editorial pick)
9.3.1	Personnel physical access authorised and managed	Editorial	Art.6(2)Art.9(4)(c)	Same topic: Physical Security (editorial pick)
9.3.1.1	Sensitive-area access authorised and revoked promptly	Editorial	Art.6(2)Art.9(4)(c)	Same topic: Physical Security (editorial pick)
9.3.2	Visitor access authorised, escorted and identifiable	Editorial	Art.6(2)Art.9(4)(c)	Same topic: Physical Security (editorial pick)
9.4.1.1	Offline backup media stored securely	Editorial	Art.12(1)Art.12(2)Art.12(3)	Same topic: Backup & Recovery (editorial pick)
9.4.2	Media classified by data sensitivity	Editorial	Art.8(1)	Same topic: Data Classification (editorial pick)
Requirement 10: Log and monitor all access to system components and cardholder data · 6
10.2.1	Audit logs enabled and active	Editorial	Art.10(3)	Same topic: Logging & Audit, Insider Threat (editorial pick)
10.3.2	Logs protected from modification	Editorial	Art.10(3)Art.13(2)Art.17(2)	Same topic: Logging & Audit, Forensics (editorial pick)
10.4.1	Security event and critical logs reviewed daily	Editorial	Art.9(1)Art.10(2)Art.10(3)	Same topic: Cont. Monitoring, SIEM / SOC (editorial pick)
10.4.1.1	Automated mechanisms for log review	Editorial	Art.10(1)	Same topic: Anomaly Detection (editorial pick)
10.5.1	Audit logs retained 12 months, three immediately available	Editorial	Art.10(3)	Same topic: Logging & Audit (editorial pick)
10.6.1	System clocks synchronised	Editorial	Art.10(3)	Same topic: Logging & Audit (editorial pick)
Requirement 11: Test security of systems and networks regularly · 3
11.3.1	Internal vulnerability scans every three months	Editorial	Art.8(2)Art.25(1)Art.26(1)+1	Same topic: Vulnerability Mgmt (editorial pick)
11.3.2	External ASV scans every three months	Editorial	Art.8(2)Art.25(1)Art.26(1)+1	Same topic: Vulnerability Mgmt (editorial pick)
11.5.1	Intrusion detection or prevention on network traffic	Editorial	Art.10(1)Art.10(2)	Same topic: Intrusion Detection (editorial pick)
Requirement 12: Support information security with organizational policies and programs · 21
12.1.1	Information security policy established and published	Editorial	Art.5(2)(b)Art.6(5)Art.9(4)(a)	Same topic: Governance Policy (editorial pick)
12.1.2	Security policy reviewed at least annually	Editorial	Art.5(2)(b)Art.6(5)Art.9(4)(a)	Same topic: Governance Policy (editorial pick)
12.1.3	Security roles and responsibilities defined	Editorial	Art.5(2)(c)Art.5(3)Art.6(4)	Same topic: Roles & Responsibilities (editorial pick)
12.1.4	Executive responsibility for information security assigned	Editorial	Art.5(2)(c)Art.5(3)Art.6(4)	Same topic: Roles & Responsibilities (editorial pick)
12.3.1	Targeted risk analysis for flexible-frequency requirements	Editorial	Art.5(2)(a)Art.6(1)Art.6(8)+5	Same topic: Risk Management (editorial pick)
12.4.2	Service providers: quarterly reviews of operational tasks	Editorial	Art.5(2)(f)Art.6(6)Art.6(7)	Same topic: Compliance (editorial pick)
12.5.1	Inventory of in-scope system components	Editorial	Art.8(1)Art.8(4)Art.8(6)	Same topic: Asset Management (editorial pick)
12.5.2	PCI DSS scope confirmed annually and on change	Editorial	Art.8(1)Art.11(5)	Same topic: Business Environment (editorial pick)
12.6.1	Formal security awareness programme	Editorial	Art.5(4)Art.13(6)	Same topic: Awareness & Training (editorial pick)
12.6.3	Awareness training on hire and at least annually	Editorial	Art.5(4)Art.13(6)	Same topic: Awareness & Training (editorial pick)
12.7.1	Personnel screened before hire	Editorial	Art.10(3)	Same topic: Insider Threat (editorial pick)
12.8.1	List of third-party service providers kept	Editorial	Art.28(2)Art.28(3)Art.28(4)+6	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)
12.8.2	Written agreements with service providers	Editorial	Art.28(3)Art.28(4)Art.28(5)+3	Same topic: Vendor Risk Mgmt (editorial pick)
12.8.3	Due diligence before engaging service providers	Editorial	Art.28(3)Art.28(4)Art.28(5)+3	Same topic: Vendor Risk Mgmt (editorial pick)
12.8.4	Service provider compliance monitored annually	Editorial	Art.28(3)Art.28(4)Art.28(5)+3	Same topic: Vendor Risk Mgmt (editorial pick)
12.8.5	Responsibilities split with each provider documented	Editorial	Art.28(3)Art.28(4)Art.28(5)+3	Same topic: Vendor Risk Mgmt (editorial pick)
12.10.1	Incident response plan ready to activate	Editorial	Art.11(1)Art.11(2)(b)Art.11(2)(c)+12	Same topic: Business Continuity, Incident Response, Mitigation (editorial pick)
12.10.2	Incident response plan reviewed and tested annually	Editorial	Art.11(2)(b)Art.17(1)Art.17(3)+1	Same topic: Incident Response (editorial pick)
12.10.3	Incident response staff available around the clock	Editorial	Art.11(2)(b)Art.17(1)Art.17(3)+1	Same topic: Incident Response (editorial pick)
12.10.4	Incident response staff trained	Editorial	Art.11(2)(b)Art.17(1)Art.17(3)+1	Same topic: Incident Response (editorial pick)
12.10.6	Plan updated from lessons learned and industry changes	Editorial	Art.13(2)Art.13(3)	Same topic: Lessons Learned (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.

PCI DSS vs DORA

Have PCI DSS → need DORA

Have DORA → need PCI DSS

By topic