Comparison
PCI DSS vs Essential Eight
PCI DSS v4.0.1 · ASD Essential Eight · data 2026-10-27
Requirement-level comparison of PCI DSS v4.0.1 and ASD Essential Eight, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 126 ASD Essential Eight requirements, 57 map to something in PCI DSS, 69 are only loosely related, and 0 have no mapping in our data.
Essential Eight here means the ISM controls ASD tags for Maturity Levels One to Three; each row shows its levels (ML1–ML3). ASD publishes no crosswalk to other frameworks, so every match is ControlMapping editorial.
Check these: only loosely related (a shared CSF outcome, not a mapping) (69)
| Essential Eight | Requirement | Match | PCI DSS | Evidence |
|---|---|---|---|---|
| Patch applications · 6 | ||||
| ISM-0304 | ML3 Applications other than office productivity suites, web browsers and their extensions… | 6.3.16.3.26.3.3+4 | Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| ISM-1690 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… | 6.3.16.3.26.3.3+4 | Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| ISM-1692 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… | 6.3.16.3.26.3.3+4 | Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| ISM-1700 | ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office… | 6.3.16.3.26.3.3+4 | Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| ISM-1901 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when… | 6.3.16.3.26.3.3+4 | Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| ISM-1905 | ML1, ML2, ML3 Online services that are no longer supported by vendors are removed | 6.3.16.3.26.3.3+4 | Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| Patch operating systems · 10 | ||||
| ISM-1407 | ML3 The latest release, or the previous release, of operating systems are used | 6.3.16.3.212.3.4+5 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1694 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… | 6.3.16.3.212.3.4+5 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1696 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… | 6.3.16.3.212.3.4+5 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1697 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… | 6.3.16.3.212.3.4+5 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1703 | ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers | 6.3.16.3.212.3.4+5 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1879 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release… | 6.3.16.3.212.3.4+5 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1900 | ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware | 6.3.16.3.212.3.4+5 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1902 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of… | 6.3.16.3.212.3.4+5 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1903 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release… | 6.3.16.3.212.3.4+5 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1904 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release… | 6.3.16.3.212.3.4+5 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| Multi-factor authentication · 9 | ||||
| ISM-1505 | ML3 Multi-factor authentication is used to authenticate human users of data repositories | 2.2.22.3.13.5.1.3+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1680 | ML1, ML2, ML3 Multi-factor authentication (where available) is used to authenticate human users to… | 2.2.22.3.13.5.1.3+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1681 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate customers to online customer… | 2.2.22.3.13.5.1.3+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1682 | ML2, ML3 Multi-factor authentication used for authenticating human users of systems is… | 2.2.22.3.13.5.1.3+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1873 | ML2 Multi-factor authentication used for authenticating customers of online customer services provides a… | 2.2.22.3.13.5.1.3+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1874 | ML3 Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant | 2.2.22.3.13.5.1.3+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1892 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that… | 2.2.22.3.13.5.1.3+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1893 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online customer services that process… | 2.2.22.3.13.5.1.3+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1894 | ML3 Multi-factor authentication used for authenticating human users of data repositories is… | 2.2.22.3.13.5.1.3+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| Restrict administrative privileges · 11 | ||||
| ISM-1649 | ML3 Just-in-time administration is used for the administration of systems and their resources | 7.1.17.2.17.2.2+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1650 | ML2, ML3 Privileged user account and security group management events are centrally logged | 7.1.17.2.17.2.2+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1685 | ML2, ML3 Credentials for break glass accounts, local administrator accounts and service accounts… | 7.1.17.2.17.2.2+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1686 | ML3 Credential Guard functionality is enabled | 7.1.17.2.17.2.2+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1687 | ML2, ML3 Privileged operating environments are not virtualised within unprivileged operating… | 7.1.17.2.17.2.2+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1688 | ML1, ML2, ML3 Unprivileged user accounts cannot be used to log on to privileged operating environments | 7.1.17.2.17.2.2+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1689 | ML1, ML2, ML3 Privileged user accounts (excluding local administrator accounts) cannot be used to log… | 7.1.17.2.17.2.2+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1861 | ML3 Local Security Authority protection functionality is enabled | 7.1.17.2.17.2.2+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1883 | ML1, ML2, ML3 Privileged user accounts explicitly authorised to access online services are strictly… | 7.1.17.2.17.2.2+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1897 | ML3 Remote Credential Guard functionality is enabled | 7.1.17.2.17.2.2+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1898 | ML3 Secure Admin Workstations are used in the performance of administrative activities | 7.1.17.2.17.2.2+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| Application control · 5 | ||||
| ISM-1582 | ML2, ML3 Application control rulesets are validated at least annually | 2.2.15.3.26.4.3 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1656 | ML3 Application control is implemented on non-internet-facing servers | 2.2.15.3.26.4.3 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1658 | ML3 Application control restricts the execution of drivers to an organisation-approved set | 2.2.15.3.26.4.3 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1659 | ML3 Microsoft’s vulnerable driver blocklist is implemented | 2.2.15.3.26.4.3 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1871 | ML2, ML3 Application control is applied to all locations other than user profiles and temporary… | 2.2.15.3.26.4.3 | Only shares CSF PR.PS-05: related, not a mapping | |
| Restrict Microsoft Office macros · 10 | ||||
| ISM-1487 | ML3 Only privileged human users responsible for checking that Microsoft Office macros are… | 2.2.12.2.25.3.2+1 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1489 | ML1, ML2, ML3 Microsoft Office macro security settings cannot be changed by human users | 2.2.12.2.25.3.2+1 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1671 | ML1, ML2, ML3 Microsoft Office macros are disabled for human users that do not have a demonstrated… | 2.2.12.2.25.3.2+1 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1672 | ML1, ML2, ML3 Microsoft Office macro antivirus scanning is enabled | 2.2.12.2.25.3.2+1 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1673 | ML2, ML3 Microsoft Office macros are blocked from making Win32 API calls | 2.2.12.2.25.3.2+1 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1674 | ML3 Only Microsoft Office macros running from within a sandboxed environment, a Trusted… | 2.2.12.2.25.3.2+1 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1675 | ML3 Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled… | 2.2.12.2.25.3.2+1 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1676 | ML3 Microsoft Office’s list of trusted publishers is validated at least annually | 2.2.12.2.25.3.2+1 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1890 | ML3 Microsoft Office macros are checked to ensure they are free of malicious code before… | 2.2.12.2.25.3.2+1 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1891 | ML3 Microsoft Office macros digitally signed by signatures other than V3 signatures cannot… | 2.2.12.2.25.3.2+1 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| User application hardening · 13 | ||||
| ISM-1485 | ML1, ML2, ML3 Web browsers do not process web advertisements from the internet | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1486 | ML1, ML2, ML3 Web browsers do not process Java from the internet | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1542 | ML2, ML3 Microsoft Office is configured to prevent activation of Object Linking and Embedding… | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1622 | ML3 PowerShell is configured to use Constrained Language Mode | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1655 | ML3 .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1667 | ML2, ML3 Microsoft Office is blocked from creating child processes | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1668 | ML2, ML3 Microsoft Office is blocked from creating executable content | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1669 | ML2, ML3 Microsoft Office is blocked from injecting code into other processes | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1670 | ML2, ML3 PDF applications are blocked from creating child processes | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1823 | ML2, ML3 Office productivity suite security settings cannot be changed by human users | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1824 | ML2, ML3 PDF application security settings cannot be changed by human users | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1889 | ML2, ML3 Command line process creation events are centrally logged | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1896 | ML3 Memory integrity functionality is enabled | 2.2.12.2.2 | Only shares CSF PR.PS-01: related, not a mapping | |
| Regular backups · 5 | ||||
| ISM-1705 | ML2, ML3 Privileged user accounts (excluding backup administrator accounts) cannot access… | 9.4.1.19.4.1.212.10.1+3 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1706 | ML3 Privileged user accounts (excluding backup administrator accounts) cannot access their… | 9.4.1.19.4.1.212.10.1+3 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1708 | ML3 Backup administrator accounts are prevented from modifying and deleting backups during… | 9.4.1.19.4.1.212.10.1+3 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1812 | ML1, ML2, ML3 Unprivileged user accounts cannot access backups belonging to other user accounts | 9.4.1.19.4.1.212.10.1+3 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1813 | ML3 Unprivileged user accounts cannot access their own backups | 9.4.1.19.4.1.212.10.1+3 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
Mapped (57)
| Essential Eight | Requirement | Match | PCI DSS | Evidence |
|---|---|---|---|---|
| Patch applications · 6 | ||||
| ISM-1691 | ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release | Editorial | 6.3.16.3.3 | Same topic: Patch Management (editorial pick) |
| ISM-1693 | ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in applications other… | Editorial | 6.3.16.3.3 | Same topic: Patch Management (editorial pick) |
| ISM-1698 | ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online… | Editorial | 6.3.111.3.111.3.2 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1699 | ML1, ML2, ML3 A vulnerability scanner is used at least weekly to identify missing patches or updates… | Editorial | 6.3.111.3.111.3.2 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1704 | ML1, ML2, ML3 Office productivity suites, web browsers and their extensions, email clients, PDF… | Editorial | 6.3.16.3.3 | Same topic: Patch Management (editorial pick) |
| ISM-1876 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of… | Editorial | 6.3.16.3.3 | Same topic: Patch Management (editorial pick) |
| Patch applications & Patch operating systems · 2 | ||||
| ISM-1807 | ML1, ML2, ML3 An automated method of asset discovery is used at least fortnightly to support the… | Editorial | 6.3.16.3.211.3.1+2 | Same topic: Vulnerability Mgmt, Asset Management (editorial pick) |
| ISM-1808 | ML1, ML2, ML3 A vulnerability scanner with an up-to-date vulnerability database is used for… | Editorial | 6.3.111.3.111.3.2 | Same topic: Vulnerability Mgmt (editorial pick) |
| Patch operating systems · 5 | ||||
| ISM-1501 | ML1, ML2, ML3 Operating systems that are no longer supported by vendors are replaced | Editorial | 6.3.16.3.3 | Same topic: Patch Management (editorial pick) |
| ISM-1695 | ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release | Editorial | 6.3.16.3.3 | Same topic: Patch Management (editorial pick) |
| ISM-1701 | ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in… | Editorial | 6.3.111.3.111.3.2 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1702 | ML1, ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of… | Editorial | 6.3.111.3.111.3.2 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1877 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours… | Editorial | 6.3.16.3.3 | Same topic: Patch Management (editorial pick) |
| Multi-factor authentication · 7 | ||||
| ISM-0974 | ML2, ML3 Multi-factor authentication is used to authenticate unprivileged human users of systems | Editorial | 8.4.18.4.28.4.3+1 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1173 | ML2, ML3 Multi-factor authentication is used to authenticate privileged human users of systems | Editorial | 8.4.18.4.28.4.3+1 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1401 | ML1, ML2, ML3 Multi-factor authentication uses either: something people have and something people… | Editorial | 8.4.18.4.28.4.3+1 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1504 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online services that process… | Editorial | 8.4.18.4.28.4.3+1 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1679 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online services that process, store or… | Editorial | 8.4.18.4.28.4.3+1 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1683 | ML2, ML3 Successful and unsuccessful multi-factor authentication events are centrally logged | Editorial | 10.2.110.3.210.5.1+1 | Same topic: Logging & Audit (editorial pick) |
| ISM-1872 | ML2, ML3 Multi-factor authentication used for authenticating human users of online services is… | Editorial | 8.4.18.4.28.4.3+1 | Same topic: Multi-Factor Auth (editorial pick) |
| Restrict administrative privileges · 9 | ||||
| ISM-0445 | ML1, ML2, ML3 Privileged human users are assigned a dedicated privileged user account to be used… | Editorial | 7.2.2 | Same topic: Privileged Access (editorial pick) |
| ISM-1175 | ML1, ML2, ML3 Privileged user accounts (excluding those explicitly authorised to access online… | Editorial | 7.2.2 | Same topic: Privileged Access (editorial pick) |
| ISM-1380 | ML1, ML2, ML3 Privileged human users use separate privileged and unprivileged operating environments | Editorial | 7.2.2 | Same topic: Privileged Access (editorial pick) |
| ISM-1387 | ML2, ML3 Administrative activities are conducted through jump servers | Editorial | 7.2.2 | Same topic: Privileged Access (editorial pick) |
| ISM-1507 | ML1, ML2, ML3 Requests for privileged access to systems and their resources are validated when first… | Editorial | 7.2.2 | Same topic: Privileged Access (editorial pick) |
| ISM-1508 | ML3 Privileged access to systems and their resources is limited to only what is required… | Editorial | 7.2.2 | Same topic: Privileged Access (editorial pick) |
| ISM-1509 | ML2, ML3 Privileged access events are centrally logged | Editorial | 10.2.110.3.210.5.1+1 | Same topic: Logging & Audit (editorial pick) |
| ISM-1647 | ML2, ML3 Privileged access to systems and their resources are disabled after 12 months unless… | Editorial | 7.2.2 | Same topic: Privileged Access (editorial pick) |
| ISM-1648 | ML2, ML3 Privileged access to systems and their resources are disabled after 45 days of inactivity | Editorial | 7.2.2 | Same topic: Privileged Access (editorial pick) |
| Application control · 6 | ||||
| ISM-0843 | ML1, ML2, ML3 Application control is implemented on workstations | Editorial | 5.2.15.2.25.3.2 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1490 | ML2, ML3 Application control is implemented on internet-facing servers | Editorial | 5.2.15.2.25.3.2 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1544 | ML2, ML3 Microsoft’s recommended application blocklist is implemented | Editorial | 5.2.15.2.25.3.2 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1657 | ML1, ML2, ML3 Application control restricts the execution of executables, libraries, scripts… | Editorial | 5.2.15.2.25.3.2 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1660 | ML2, ML3 Allowed and blocked application control events are centrally logged | Editorial | 10.2.110.3.210.5.1+1 | Same topic: Logging & Audit (editorial pick) |
| ISM-1870 | ML1, ML2, ML3 Application control is applied to user profiles and temporary folders used by operating… | Editorial | 5.2.15.2.25.3.2 | Same topic: Endpoint Protection (editorial pick) |
| Restrict Microsoft Office macros · 1 | ||||
| ISM-1488 | ML1, ML2, ML3 Microsoft Office macros in files originating from the internet are blocked | Editorial | 5.2.15.2.25.3.2+1 | Same topic: Endpoint Protection (editorial pick) |
| User application hardening · 7 | ||||
| ISM-1412 | ML2, ML3 Web browsers are hardened using ASD and vendor hardening guidance, with the most… | Editorial | 2.2.12.2.2 | Same topic: Secure Config (editorial pick) |
| ISM-1585 | ML1, ML2, ML3 Web browser security settings cannot be changed by human users | Editorial | 2.2.12.2.2 | Same topic: Secure Config (editorial pick) |
| ISM-1621 | ML3 Windows PowerShell 2.0 is disabled or removed | Editorial | 2.2.12.2.2 | Same topic: Secure Config (editorial pick) |
| ISM-1623 | ML2, ML3 PowerShell module logging, script block logging and transcription events are centrally… | Editorial | 10.2.110.3.210.5.1+1 | Same topic: Logging & Audit (editorial pick) |
| ISM-1654 | ML1, ML2, ML3 Internet Explorer 11 is disabled or removed | Editorial | 2.2.12.2.2 | Same topic: Secure Config (editorial pick) |
| ISM-1859 | ML2, ML3 Office productivity suites are hardened using ASD and vendor hardening guidance, with… | Editorial | 2.2.12.2.2 | Same topic: Secure Config (editorial pick) |
| ISM-1860 | ML2, ML3 PDF applications are hardened using ASD and vendor hardening guidance, with the most… | Editorial | 2.2.12.2.2 | Same topic: Secure Config (editorial pick) |
| Regular backups · 6 | ||||
| ISM-1511 | ML1, ML2, ML3 Backups of data, applications and settings are performed and retained in accordance… | Editorial | 9.4.1.1 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1515 | ML1, ML2, ML3 Restoration of data, applications and settings from backups to a common point in time… | Editorial | 9.4.1.112.10.1 | Same topic: Backup & Recovery, Disaster Recovery (editorial pick) |
| ISM-1707 | ML2, ML3 Privileged user accounts (excluding backup administrator accounts) are prevented from… | Editorial | 9.4.1.1 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1810 | ML1, ML2, ML3 Backups of data, applications and settings are synchronised to enable restoration to a… | Editorial | 9.4.1.1 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1811 | ML1, ML2, ML3 Backups of data, applications and settings are retained in a secure and resilient manner | Editorial | 9.4.1.1 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1814 | ML1, ML2, ML3 Unprivileged user accounts are prevented from modifying and deleting backups | Editorial | 9.4.1.1 | Same topic: Backup & Recovery (editorial pick) |
| Logging and incident response (all strategies) · 8 | ||||
| ISM-0109 | ML3 Event logs from workstations are analysed in a timely manner to detect cyber security… | Editorial | 10.4.1 | Same topic: Cont. Monitoring (editorial pick) |
| ISM-0123 | ML2, ML3 Cyber security incidents are reported to the chief information security officer, or one… | Editorial | 12.10.1 | Same topic: Reporting (editorial pick) |
| ISM-0140 | ML2, ML3 Cyber security incidents are reported to ASD as soon as possible after they occur or… | Editorial | 12.10.1 | Same topic: Reporting (editorial pick) |
| ISM-1228 | ML2, ML3 Cyber security events are analysed in a timely manner to identify cyber security incidents | Editorial | 10.4.110.4.1.1 | Same topic: SIEM / SOC, Anomaly Detection (editorial pick) |
| ISM-1815 | ML2, ML3 Event logs are protected from unauthorised modification and deletion | Editorial | 10.2.110.3.210.5.1+1 | Same topic: Logging & Audit (editorial pick) |
| ISM-1819 | ML2, ML3 Following the identification of a cyber security incident, the cyber security incident… | Editorial | 12.10.112.10.212.10.3+1 | Same topic: Incident Response (editorial pick) |
| ISM-1906 | ML2, ML3 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… | Editorial | 10.4.1 | Same topic: Cont. Monitoring, SIEM / SOC (editorial pick) |
| ISM-1907 | ML3 Event logs from non-internet-facing servers are analysed in a timely manner to detect… | Editorial | 10.4.1 | Same topic: Cont. Monitoring (editorial pick) |
Of 260 PCI DSS v4.0.1 requirements, 28 map to something in Essential Eight, 55 are only loosely related, and 177 have no mapping in our data.
Likely new work: PCI DSS requirements with no mapping to Essential Eight (177)
| PCI DSS | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| Requirement 1: Install and maintain network security controls · 17 | ||||
| 1.1.1 | Network security policies documented and kept current | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.1.2 | Roles for network security controls assigned | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.2.1 | Configuration standards for network security controls | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.2.2 | Network connection changes go through change control | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.2.5 | Allowed services, protocols and ports approved | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.2.6 | Security features defined for insecure services | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.2.7 | Network security control rules reviewed every six months | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.2.8 | Network security control configuration files secured | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.3.1 | Inbound traffic to the CDE restricted | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.3.2 | Outbound traffic from the CDE restricted | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.3.3 | Network controls between wireless networks and the CDE | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.4.1 | Network controls between trusted and untrusted networks | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.4.2 | Inbound traffic from untrusted networks restricted | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.4.3 | Anti-spoofing measures in place | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.4.4 | Stored cardholder data not reachable from untrusted networks | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.4.5 | Internal IP addresses and routing not disclosed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 1.5.1 | Controls on devices connecting to untrusted networks and the CDE | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Requirement 2: Apply secure configurations to all system components · 8 | ||||
| 2.1.1 | Secure configuration policies documented and kept current | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 2.1.2 | Roles for secure configuration assigned | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 2.2.3 | Functions with different security levels kept apart | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 2.2.4 | Only necessary services and functions enabled | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 2.2.5 | Insecure services justified and secured | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 2.2.6 | System security parameters set to prevent misuse | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 2.2.7 | Non-console administrative access encrypted | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 2.3.2 | Wireless keys changed when key holders leave | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Requirement 3: Protect stored account data · 25 | ||||
| 3.1.1 | Stored account data policies documented and kept current | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.1.2 | Roles for protecting stored account data assigned | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.2.1 | Account data storage minimised, with retention and disposal | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.3.1 | Sensitive authentication data not kept after authorisation | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.3.1.1 | Full track data not kept after authorisation | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.3.1.2 | Card verification code not kept after authorisation | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.3.1.3 | PIN and PIN block not kept after authorisation | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.3.2 | Sensitive authentication data encrypted before authorisation | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.3.3 | Issuer storage of sensitive authentication data limited and protected | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.4.1 | PAN masked when displayed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.5.1 | PAN rendered unreadable wherever stored | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.5.1.1 | Hashes of PAN are keyed cryptographic hashes | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.5.1.2 | Disk-level encryption used only where it suffices | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.6.1 | Procedures protect keys that secure stored account data | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.6.1.1 | Service providers document their cryptographic architecture | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.6.1.2 | Secret and private keys stored in approved forms | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.6.1.3 | Cleartext key components accessible to fewest custodians | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.6.1.4 | Keys stored in the fewest possible locations | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.7.2 | Key management: secure key distribution | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.7.3 | Key management: secure key storage | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.7.5 | Key management: retiring weakened or compromised keys | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.7.6 | Key management: split knowledge and dual control | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.7.7 | Key management: preventing unauthorised key substitution | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.7.8 | Key custodians formally acknowledge their responsibilities | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 3.7.9 | Service providers give customers key-handling guidance | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Requirement 4: Protect cardholder data with strong cryptography during transmission · 4 | ||||
| 4.1.1 | Data-in-transit policies documented and kept current | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 4.1.2 | Roles for protecting data in transit assigned | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 4.2.1.2 | Strong cryptography on wireless networks carrying PAN | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 4.2.2 | PAN secured when sent by end-user messaging | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Requirement 5: Protect all systems and networks from malicious software · 9 | ||||
| 5.1.1 | Anti-malware policies documented and kept current | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 5.1.2 | Roles for malware protection assigned | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 5.2.3 | Systems without anti-malware periodically re-evaluated | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 5.2.3.1 | Re-evaluation frequency set by targeted risk analysis | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 5.3.1 | Anti-malware kept up to date | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 5.3.2.1 | Scan frequency set by targeted risk analysis | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 5.3.3 | Removable media scanned or analysed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 5.3.4 | Anti-malware audit logs enabled and retained | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 5.3.5 | Users cannot disable or alter anti-malware | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Requirement 6: Develop and maintain secure systems and software · 9 | ||||
| 6.1.1 | Secure systems and software policies documented | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 6.1.2 | Roles for secure systems and software assigned | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 6.4.1 | Public web applications protected against attacks | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 6.5.1 | Production changes follow change control procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 6.5.2 | PCI DSS requirements re-confirmed after significant changes | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 6.5.3 | Pre-production environments separated from production | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 6.5.4 | Duties separated between production and pre-production | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 6.5.5 | Live PANs not used in pre-production | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 6.5.6 | Test data and accounts removed before go-live | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Requirement 7: Restrict access to system components and cardholder data by business need to know · 7 | ||||
| 7.1.2 | Roles for access restriction assigned | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 7.2.3 | Privileges approved by authorised personnel | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 7.2.5 | System and application accounts least privilege | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 7.2.6 | Access to cardholder data repositories restricted | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 7.3.1 | Access control system restricts access by need | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 7.3.2 | Access control system enforces assigned permissions | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 7.3.3 | Access control system set to deny by default | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Requirement 8: Identify users and authenticate access to system components · 14 | ||||
| 8.1.2 | Roles for identification and authentication assigned | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.2.1 | Every user has a unique ID | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.2.3 | Service providers use unique credentials per customer | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.2.4 | User ID changes authorised and controlled | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.2.5 | Access revoked immediately on termination | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.2.7 | Third-party remote access accounts enabled only when needed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.3.2 | Authentication factors unreadable in transit and storage | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.3.3 | Identity verified before changing authentication factors | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.3.4 | Account lockout after repeated failed attempts | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.3.5 | First-use and reset passwords unique and changed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.3.11 | Tokens, smart cards and certificates assigned to individuals | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.6.1 | Interactive use of system accounts managed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.6.2 | No hard-coded passwords for system accounts | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 8.6.3 | System account passwords protected and changed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Requirement 9: Restrict physical access to cardholder data · 20 | ||||
| 9.1.1 | Physical security policies documented and kept current | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.1.2 | Roles for physical security assigned | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.2.1 | Facility entry controls restrict CDE access | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.2.1.1 | Access to sensitive areas monitored by camera or access control | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.2.2 | Publicly accessible network jacks restricted | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.2.3 | Physical access to network hardware restricted | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.3.1 | Personnel physical access authorised and managed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.3.2 | Visitor access authorised, escorted and identifiable | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.3.3 | Visitor badges returned or deactivated | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.3.4 | Visitor log maintained and retained | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.4.1 | Media with cardholder data physically secured | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.4.2 | Media classified by data sensitivity | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.4.3 | Media sent off site tracked and secured | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.4.4 | Management approves media moved off site | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.4.5 | Inventory logs of electronic media kept | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.4.5.1 | Electronic media inventories at least annually | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.4.6 | Hard-copy media destroyed when no longer needed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.5.1 | Card-reading (POI) devices protected from tampering | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.5.1.2.1 | Inspection frequency set by targeted risk analysis | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9.5.1.3 | Staff trained to spot POI tampering | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Requirement 10: Log and monitor all access to system components and cardholder data · 16 | ||||
| 10.1.1 | Logging and monitoring policies documented | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.1.2 | Roles for logging and monitoring assigned | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.2.1.1 | Logs capture user access to cardholder data | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.2.1.2 | Logs capture administrative actions | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.2.1.3 | Logs capture access to audit logs | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.2.1.4 | Logs capture invalid access attempts | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.2.1.5 | Logs capture credential and privilege changes | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.2.1.6 | Logs capture starting, stopping or pausing logging | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.2.1.7 | Logs capture system-level object changes | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.2.2 | Log entries record who, what, when, where and outcome | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.4.2 | Other logs reviewed periodically | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.4.3 | Exceptions and anomalies addressed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.6.2 | Time configuration correct and consistent | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.7.1 | Service providers detect security control failures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.7.2 | Critical security control failures detected and reported | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 10.7.3 | Security control failures responded to promptly | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Requirement 11: Test security of systems and networks regularly · 15 | ||||
| 11.1.1 | Security testing policies documented and kept current | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.1.2 | Roles for security testing assigned | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.2.2 | Inventory of authorised wireless access points | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.3.1.1 | Lower-ranked vulnerabilities handled by risk analysis | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.3.1.2 | Internal scans use authenticated scanning | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.3.1.3 | Internal scans after significant changes | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.3.2.1 | External scans after significant changes | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.4.1 | Penetration testing methodology defined | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.4.2 | Internal penetration test at least annually | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.4.3 | External penetration test at least annually | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.4.5 | Segmentation controls tested at least annually | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.4.6 | Service providers test segmentation every six months | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.4.7 | Multi-tenant providers support customer penetration tests | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.5.1.1 | Service providers detect covert malware communication | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 11.5.2 | Change-detection on critical files | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Requirement 12: Support information security with organizational policies and programs · 23 | ||||
| 12.1.1 | Information security policy established and published | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.1.2 | Security policy reviewed at least annually | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.1.4 | Executive responsibility for information security assigned | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.2.1 | Acceptable use policies for end-user technologies | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.3.1 | Targeted risk analysis for flexible-frequency requirements | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.3.2 | Targeted risk analysis for customised approach | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.4.1 | Service providers: executive responsibility for PCI DSS compliance | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.4.2 | Service providers: quarterly reviews of operational tasks | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.4.2.1 | Service providers: quarterly review results documented | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.5.2 | PCI DSS scope confirmed annually and on change | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.5.2.1 | Service providers confirm scope every six months | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.5.3 | Service providers review scope after organisational change | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.6.1 | Formal security awareness programme | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.6.2 | Awareness programme reviewed annually | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.6.3 | Awareness training on hire and at least annually | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.6.3.1 | Training covers phishing and social engineering | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.6.3.2 | Training covers acceptable use of technology | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.7.1 | Personnel screened before hire | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.9.1 | Service providers acknowledge responsibilities to customers | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.9.2 | Service providers support customer compliance requests | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.10.4.1 | Training frequency set by targeted risk analysis | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.10.5 | Plan covers alerts from security monitoring | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12.10.7 | Procedures for PAN found where it shouldn't be | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Appendix A: additional requirements · 10 | ||||
| A1.1.1 | Multi-tenant providers: separate provider and customer environments | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A1.1.2 | Multi-tenant providers: customers confined to their own environment | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A1.1.3 | Multi-tenant providers: customers reach only their own data | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A1.1.4 | Multi-tenant providers: separation tested every six months | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A1.2.1 | Multi-tenant providers: audit logging for each customer | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A1.2.2 | Multi-tenant providers: support customer forensic investigations | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A1.2.3 | Multi-tenant providers: report suspected incidents to customers | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A2.1.1 | POI terminals using SSL or early TLS not exploitable | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A2.1.2 | Service providers: migration plan off SSL and early TLS | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A2.1.3 | Service providers offer a secure connection option | No mapping in our data | — | No mapping to Essential Eight in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (55)
| PCI DSS | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| Requirement 1: Install and maintain network security controls · 2 | ||||
| 1.2.3 | Accurate network diagram maintained | ISM-1228ISM-1515ISM-1807 | Only shares CSF DE.AE-04, RC.RP-02, ID.AM-01: related, not a mapping | |
| 1.2.4 | Accurate account-data flow diagram maintained | ISM-0109ISM-1228ISM-1906+5 | Only shares CSF DE.AE-03, DE.CM-01, DE.AE-04: related, not a mapping | |
| Requirement 2: Apply secure configurations to all system components · 1 | ||||
| 2.3.1 | Wireless vendor defaults changed | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| Requirement 3: Protect stored account data · 4 | ||||
| 3.4.2 | PAN copying prevented over remote-access technologies | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| 3.5.1.3 | Disk encryption access managed separately from OS access | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| 3.7.1 | Key management: strong key generation | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| 3.7.4 | Key management: key changes at end of cryptoperiod | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| Requirement 4: Protect cardholder data with strong cryptography during transmission · 2 | ||||
| 4.2.1 | Strong cryptography for PAN over open, public networks | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| 4.2.1.1 | Inventory of trusted keys and certificates kept | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| Requirement 6: Develop and maintain secure systems and software · 7 | ||||
| 6.2.1 | Bespoke and custom software developed securely | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| 6.2.2 | Developers trained in secure software development | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| 6.2.3 | Custom code reviewed before release | ISM-1515ISM-1807 | Only shares CSF RC.RP-05, ID.AM-08: related, not a mapping | |
| 6.2.3.1 | Manual code reviews approved by someone else | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| 6.2.4 | Coding techniques prevent common software attacks | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| 6.4.2 | Automated solution blocks attacks on public web apps | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-01: related, not a mapping | |
| 6.4.3 | Payment page scripts authorised and integrity-checked | ISM-0843ISM-1488ISM-1490+5 | Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping | |
| Requirement 7: Restrict access to system components and cardholder data by business need to know · 4 | ||||
| 7.1.1 | Access restriction policies documented and kept current | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| 7.2.1 | Access control model defined | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| 7.2.4 | User accounts and privileges reviewed every six months | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| 7.2.5.1 | System and application account access periodically reviewed | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| Requirement 8: Identify users and authenticate access to system components · 11 | ||||
| 8.1.1 | Identification and authentication policies documented | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| 8.2.2 | Shared or generic accounts only by documented exception | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-03: related, not a mapping | |
| 8.2.6 | Inactive user accounts disabled within 90 days | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| 8.2.8 | Re-authentication after 15 minutes idle | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.1 | User and admin access requires an authentication factor | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.6 | Minimum password length and complexity | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.7 | Recent passwords cannot be reused | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.8 | Authentication guidance communicated to users | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.9 | Password-only access: change every 90 days or analyse risk | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.10 | Service providers give customers password guidance | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.10.1 | Service provider customer passwords: rotation or analysis | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| Requirement 9: Restrict physical access to cardholder data · 6 | ||||
| 9.2.4 | Consoles in sensitive areas locked when unattended | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| 9.3.1.1 | Sensitive-area access authorised and revoked promptly | ISM-1511ISM-1515ISM-1705+5 | Only shares CSF PR.DS-11: related, not a mapping | |
| 9.4.1.2 | Security of offline backup location reviewed annually | ISM-1511ISM-1515ISM-1705+5 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| 9.4.7 | Electronic media destroyed or made unrecoverable | ISM-1407ISM-1501ISM-1511+5 | Only shares CSF PR.PS-03, PR.DS-11: related, not a mapping | |
| 9.5.1.1 | Inventory of POI devices kept | ISM-1807ISM-1407ISM-1501+5 | Only shares CSF ID.AM-01, PR.PS-03: related, not a mapping | |
| 9.5.1.2 | POI devices inspected for tampering | ISM-1807 | Only shares CSF ID.AM-01: related, not a mapping | |
| Requirement 10: Log and monitor all access to system components and cardholder data · 5 | ||||
| 10.3.1 | Read access to logs limited to need | ISM-1228ISM-1509ISM-1623+4 | Only shares CSF DE.AE-06, PR.PS-04: related, not a mapping | |
| 10.3.3 | Logs promptly backed up to a central server | ISM-1228ISM-1906ISM-0109+5 | Only shares CSF DE.AE-02, DE.AE-03, DE.AE-06: related, not a mapping | |
| 10.3.4 | File-integrity monitoring on logs | ISM-0109ISM-1228ISM-1906+5 | Only shares CSF DE.AE-02, DE.CM-09: related, not a mapping | |
| 10.4.2.1 | Review frequency set by targeted risk analysis | ISM-0109ISM-1228ISM-1509+5 | Only shares CSF DE.AE-02, PR.PS-04: related, not a mapping | |
| 10.6.3 | Time settings protected from change | ISM-1509ISM-1623ISM-1660+2 | Only shares CSF PR.PS-04: related, not a mapping | |
| Requirement 11: Test security of systems and networks regularly · 4 | ||||
| 11.2.1 | Wireless access points detected and unauthorised ones handled | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-01: related, not a mapping | |
| 11.4.4 | Penetration test findings corrected and retested | ISM-0304ISM-1407ISM-1501+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| 11.5.1 | Intrusion detection or prevention on network traffic | ISM-0109ISM-1906ISM-1907+1 | Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping | |
| 11.6.1 | Payment page changes and tampering detected | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| Requirement 12: Support information security with organizational policies and programs · 9 | ||||
| 12.1.3 | Security roles and responsibilities defined | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| 12.3.3 | Cipher suites and protocols reviewed annually | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| 12.3.4 | Hardware and software technologies reviewed annually | ISM-1807ISM-1407ISM-1501+5 | Only shares CSF ID.AM-08, PR.PS-02, PR.PS-03: related, not a mapping | |
| 12.8.1 | List of third-party service providers kept | ISM-1807 | Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping | |
| 12.8.2 | Written agreements with service providers | ISM-0123ISM-0140ISM-1819 | Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping | |
| 12.8.3 | Due diligence before engaging service providers | ISM-1807 | Only shares CSF ID.AM-04: related, not a mapping | |
| 12.8.4 | Service provider compliance monitored annually | ISM-1807 | Only shares CSF ID.AM-04: related, not a mapping | |
| 12.8.5 | Responsibilities split with each provider documented | ISM-0123ISM-0140ISM-1807 | Only shares CSF RS.CO-02, ID.AM-04: related, not a mapping | |
| 12.10.6 | Plan updated from lessons learned and industry changes | ISM-1515ISM-1819 | Only shares CSF PR.IR-03, RC.RP-02, ID.IM-04, RS.MA-03: related, not a mapping | |
Mapped (28)
| PCI DSS | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| Requirement 2: Apply secure configurations to all system components · 2 | ||||
| 2.2.1 | System configuration standards developed and maintained | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| 2.2.2 | Vendor default accounts managed or removed | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| Requirement 5: Protect all systems and networks from malicious software · 4 | ||||
| 5.2.1 | Anti-malware deployed on system components | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| 5.2.2 | Anti-malware detects, removes or contains known malware | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| 5.3.2 | Periodic scans or continuous behavioural analysis | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| 5.4.1 | Mechanisms to detect and protect against phishing | Editorial | ISM-1488 | Same topic: Email Security (editorial pick) |
| Requirement 6: Develop and maintain secure systems and software · 3 | ||||
| 6.3.1 | Vulnerabilities identified and risk-ranked | Editorial | ISM-1501ISM-1691ISM-1693+10 | Same topic: Patch Management (editorial pick) |
| 6.3.2 | Inventory of custom software and its components | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| 6.3.3 | Security patches installed promptly | Editorial | ISM-1501ISM-1691ISM-1693+4 | Same topic: Patch Management (editorial pick) |
| Requirement 7: Restrict access to system components and cardholder data by business need to know · 1 | ||||
| 7.2.2 | Access assigned by job function and least privilege | Editorial | ISM-0445ISM-1175ISM-1380+5 | Same topic: Privileged Access (editorial pick) |
| Requirement 8: Identify users and authenticate access to system components · 4 | ||||
| 8.4.1 | MFA for non-console administrative access to the CDE | Editorial | ISM-0974ISM-1173ISM-1401+3 | Same topic: Multi-Factor Auth (editorial pick) |
| 8.4.2 | MFA for all access into the CDE | Editorial | ISM-0974ISM-1173ISM-1401+3 | Same topic: Multi-Factor Auth (editorial pick) |
| 8.4.3 | MFA for remote network access | Editorial | ISM-0974ISM-1173ISM-1401+3 | Same topic: Multi-Factor Auth (editorial pick) |
| 8.5.1 | MFA systems configured to resist misuse | Editorial | ISM-0974ISM-1173ISM-1401+3 | Same topic: Multi-Factor Auth (editorial pick) |
| Requirement 9: Restrict physical access to cardholder data · 1 | ||||
| 9.4.1.1 | Offline backup media stored securely | Editorial | ISM-1511ISM-1515ISM-1707+3 | Same topic: Backup & Recovery (editorial pick) |
| Requirement 10: Log and monitor all access to system components and cardholder data · 6 | ||||
| 10.2.1 | Audit logs enabled and active | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| 10.3.2 | Logs protected from modification | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| 10.4.1 | Security event and critical logs reviewed daily | Editorial | ISM-0109ISM-1228ISM-1906+1 | Same topic: Cont. Monitoring, SIEM / SOC (editorial pick) |
| 10.4.1.1 | Automated mechanisms for log review | Editorial | ISM-1228 | Same topic: Anomaly Detection (editorial pick) |
| 10.5.1 | Audit logs retained 12 months, three immediately available | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| 10.6.1 | System clocks synchronised | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| Requirement 11: Test security of systems and networks regularly · 2 | ||||
| 11.3.1 | Internal vulnerability scans every three months | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| 11.3.2 | External ASV scans every three months | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| Requirement 12: Support information security with organizational policies and programs · 5 | ||||
| 12.5.1 | Inventory of in-scope system components | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| 12.10.1 | Incident response plan ready to activate | Editorial | ISM-0123ISM-0140ISM-1515+1 | Same topic: Reporting, Disaster Recovery (editorial pick) |
| 12.10.2 | Incident response plan reviewed and tested annually | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| 12.10.3 | Incident response staff available around the clock | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| 12.10.4 | Incident response staff trained | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
By topic
Both cover (16):
Asset ManagementVulnerability MgmtMulti-Factor AuthBackup & RecoveryPrivileged AccessEndpoint ProtectionPatch ManagementSecure ConfigEmail SecurityCont. MonitoringLogging & AuditAnomaly DetectionSIEM / SOCIncident ResponseReportingDisaster Recovery
Only PCI DSS (30):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceRisk AssessmentBusiness EnvironmentData ClassificationThreat IntelligenceAccess ControlEncryptionData ProtectionFirewall / Net SegSecure DevelopmentWeb SecurityZero TrustCloud SecurityWAFDLPIntrusion DetectionForensicsMitigationRecovery PlanningBusiness ContinuityLessons LearnedAPI SecurityInsider ThreatVendor Risk MgmtPhysical Security
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.