Comparison
PCI DSS vs NIS2
PCI DSS v4.0.1 · NIS2 Implementing Regulation (EU) 2024/2690 · data 2026-10-27
Requirement-level comparison of PCI DSS v4.0.1 and NIS2 Implementing Regulation (EU) 2024/2690, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 49 NIS2 Implementing Regulation (EU) 2024/2690 requirements, 45 map to something in PCI DSS, 3 are only loosely related, and 1 have no mapping in our data.
NIS2 here is the technical measures of Implementing Regulation (EU) 2024/2690, which applies directly to digital-infrastructure and ICT-service providers; other NIS2 entities follow their country's transposition of Article 21. Incident reporting deadlines (Article 23) are not in scope. ENISA's mapping is non-binding.
Likely new work: NIS2 requirements with no mapping to PCI DSS (1)
| NIS2 | Requirement | Match | PCI DSS | Evidence |
|---|---|---|---|---|
| 12. Asset management · 1 | ||||
| 12.5 | Deposit, return or deletion of assets upon termination of employment | No mapping in our data | — | No mapping to PCI DSS in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (3)
| NIS2 | Requirement | Match | PCI DSS | Evidence |
|---|---|---|---|---|
| 6. Security in acquisition, development and maintenance · 1 | ||||
| 6.4 | Change management, repairs and maintenance | 8.6.39.5.1.2.110.4.2.1+2 | Only shares CSF ID.RA-07: related, not a mapping | |
| 10. Human resources security · 2 | ||||
| 10.1 | Human resources security | 6.2.27.2.28.2.5+5 | Only shares CSF PR.AT-02, GV.RR-04: related, not a mapping | |
| 10.3 | Termination or change of employment procedures | 7.2.28.2.59.3.1.1+2 | Only shares CSF GV.RR-04: related, not a mapping | |
Mapped (45)
| NIS2 | Requirement | Match | PCI DSS | Evidence |
|---|---|---|---|---|
| 1. Policy on the security of network and information systems · 2 | ||||
| 1.1 | Policy on the security of network and information systems | Crosswalk | 12.1.112.1.2 | Same topic: Governance Policy |
| 1.2 | Roles, responsibilities and authorities | Crosswalk | 12.1.312.1.4 | Same topic: Roles & Responsibilities |
| 2. Risk management policy · 3 | ||||
| 2.1 | Risk management framework | Crosswalk | 12.3.1 | Same topic: Risk Management, Risk Assessment |
| 2.2 | Compliance monitoring | Crosswalk | 12.4.2 | Same topic: Compliance |
| 2.3 | Independent review of information and network security | Editorial | 12.4.2 | Same topic: Compliance (editorial pick) |
| 3. Incident handling · 6 | ||||
| 3.1 | Incident handling policy | Crosswalk | 12.10.112.10.212.10.3+1 | Same topic: Incident Response |
| 3.2 | Monitoring and logging | Crosswalk | 10.2.110.3.210.4.1+3 | Same topic: Logging & Audit, Cont. Monitoring, SIEM / SOC |
| 3.3 | Event reporting | Crosswalk | 12.10.1 | Same topic: Reporting |
| 3.4 | Event assessment and classification | Crosswalk | 10.4.110.4.1.1 | Same topic: SIEM / SOC, Anomaly Detection |
| 3.5 | Incident response | Crosswalk | 10.3.212.10.112.10.2+2 | Same topic: Forensics, Incident Response, Mitigation |
| 3.6 | Post-incident reviews | Crosswalk | 12.10.6 | Same topic: Lessons Learned |
| 4. Business continuity and crisis management · 3 | ||||
| 4.1 | Business continuity and disaster recovery plan | Crosswalk | 12.10.1 | Same topic: Recovery Planning, Business Continuity, Disaster Recovery |
| 4.2 | Backup management | Crosswalk | 9.4.1.112.10.1 | Same topic: Backup & Recovery, Disaster Recovery |
| 4.3 | Crisis management | Crosswalk | 12.10.1 | Same topic: Business Continuity |
| 5. Supply chain security · 2 | ||||
| 5.1 | Supply chain security policy | Crosswalk | 6.3.212.8.112.8.2+3 | Same topic: Supply Chain Risk, Vendor Risk Mgmt |
| 5.2 | Directory of suppliers and service providers | Crosswalk | 12.8.112.8.212.8.3+2 | Same topic: Vendor Risk Mgmt |
| 6. Security in acquisition, development and maintenance · 9 | ||||
| 6.1 | Security in acquisition of ICT services, ICT systems or ICT products | Crosswalk | 6.3.212.8.112.8.2+3 | Same topic: Supply Chain Risk, Cloud Security, Vendor Risk Mgmt |
| 6.2 | Secure development life cycle | Crosswalk | 6.2.26.2.36.2.1 | Same topic: Secure Development |
| 6.3 | Configuration management | Crosswalk | 2.2.12.2.2 | Same topic: Secure Config |
| 6.5 | Security testing | Crosswalk | 6.3.111.3.111.3.2 | Same topic: Vulnerability Mgmt |
| 6.6 | Security patch management | Crosswalk | 6.3.16.3.3 | Same topic: Patch Management |
| 6.7 | Network security | Crosswalk | 1.2.31.2.11.3.1+1 | Same topic: Firewall / Net Seg |
| 6.8 | Network segmentation | Crosswalk | 1.2.37.2.18.3.1+3 | Same topic: Firewall / Net Seg, Zero Trust |
| 6.9 | Protection against malicious and unauthorised software | Crosswalk | 5.2.15.2.25.3.2+1 | Same topic: Endpoint Protection |
| 6.10 | Vulnerability handling and disclosure | Crosswalk | 6.3.111.3.111.3.2 | Same topic: Vulnerability Mgmt |
| 7. Assessing the effectiveness of cybersecurity risk-management measures · 1 | ||||
| 7.1 | Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Crosswalk | 12.3.1 | Same topic: Risk Management |
| 8. Basic cyber hygiene practices and security training · 2 | ||||
| 8.1 | Awareness raising and basic cyber hygiene practices | Crosswalk | 12.6.112.6.3 | Same topic: Awareness & Training |
| 8.2 | Security training | Crosswalk | 12.6.112.6.3 | Same topic: Awareness & Training |
| 9. Cryptography · 1 | ||||
| 9.1 | Cryptography | Crosswalk | 3.5.13.6.14.2.1+3 | Same topic: Encryption |
| 10. Human resources security · 2 | ||||
| 10.2 | Verification of Background | Crosswalk | 10.2.112.7.1 | Same topic: Insider Threat |
| 10.4 | Disciplinary process | Crosswalk | 10.2.112.7.1 | Same topic: Insider Threat |
| 11. Access control · 7 | ||||
| 11.1 | Access control policy | Crosswalk | 7.2.17.2.27.2.4+2 | Same topic: Access Control, Zero Trust |
| 11.2 | Management of access rights | Crosswalk | 7.2.17.2.27.2.4+1 | Same topic: Access Control |
| 11.3 | Privileged accounts and system administration accounts | Crosswalk | 7.2.2 | Same topic: Privileged Access |
| 11.4 | Administration systems | Crosswalk | 7.2.2 | Same topic: Privileged Access |
| 11.5 | Identification | Crosswalk | 7.2.17.2.27.2.4+1 | Same topic: Access Control |
| 11.6 | Authentication | Crosswalk | 7.2.18.3.18.4.1+3 | Same topic: Zero Trust, Multi-Factor Auth |
| 11.7 | Multi-factor authentication | Editorial | 8.4.18.4.28.4.3+1 | Same topic: Multi-Factor Auth (editorial pick) |
| 12. Asset management · 4 | ||||
| 12.1 | Asset classification | Editorial | 9.4.2 | Same topic: Data Classification (editorial pick) |
| 12.2 | Handling of assets | Crosswalk | 3.2.13.3.13.4.1 | Same topic: Data Protection |
| 12.3 | Removable media policy | Crosswalk | 3.2.13.3.13.4.1+1 | Same topic: Data Protection |
| 12.4 | Asset inventory | Crosswalk | 6.3.212.5.1 | Same topic: Asset Management |
| 13. Environmental and physical security · 3 | ||||
| 13.1 | Supporting utilities | Crosswalk | 9.2.39.3.1.19.2.1+3 | Same topic: Physical Security |
| 13.2 | Protection against physical and environmental threats | Crosswalk | 9.2.39.3.1.19.2.1+3 | Same topic: Physical Security |
| 13.3 | Perimeter and physical access control | Crosswalk | 9.2.39.3.1.19.2.1+3 | Same topic: Physical Security |
Of 260 PCI DSS v4.0.1 requirements, 72 map to something in NIS2, 78 are only loosely related, and 110 have no mapping in our data.
Likely new work: PCI DSS requirements with no mapping to NIS2 (110)
| PCI DSS | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| Requirement 1: Install and maintain network security controls · 12 | ||||
| 1.2.2 | Network connection changes go through change control | No mapping in our data | — | No mapping to NIS2 in our data. |
| 1.2.5 | Allowed services, protocols and ports approved | No mapping in our data | — | No mapping to NIS2 in our data. |
| 1.2.6 | Security features defined for insecure services | No mapping in our data | — | No mapping to NIS2 in our data. |
| 1.2.7 | Network security control rules reviewed every six months | No mapping in our data | — | No mapping to NIS2 in our data. |
| 1.2.8 | Network security control configuration files secured | No mapping in our data | — | No mapping to NIS2 in our data. |
| 1.3.2 | Outbound traffic from the CDE restricted | No mapping in our data | — | No mapping to NIS2 in our data. |
| 1.3.3 | Network controls between wireless networks and the CDE | No mapping in our data | — | No mapping to NIS2 in our data. |
| 1.4.2 | Inbound traffic from untrusted networks restricted | No mapping in our data | — | No mapping to NIS2 in our data. |
| 1.4.3 | Anti-spoofing measures in place | No mapping in our data | — | No mapping to NIS2 in our data. |
| 1.4.4 | Stored cardholder data not reachable from untrusted networks | No mapping in our data | — | No mapping to NIS2 in our data. |
| 1.4.5 | Internal IP addresses and routing not disclosed | No mapping in our data | — | No mapping to NIS2 in our data. |
| 1.5.1 | Controls on devices connecting to untrusted networks and the CDE | No mapping in our data | — | No mapping to NIS2 in our data. |
| Requirement 2: Apply secure configurations to all system components · 6 | ||||
| 2.2.3 | Functions with different security levels kept apart | No mapping in our data | — | No mapping to NIS2 in our data. |
| 2.2.4 | Only necessary services and functions enabled | No mapping in our data | — | No mapping to NIS2 in our data. |
| 2.2.5 | Insecure services justified and secured | No mapping in our data | — | No mapping to NIS2 in our data. |
| 2.2.6 | System security parameters set to prevent misuse | No mapping in our data | — | No mapping to NIS2 in our data. |
| 2.2.7 | Non-console administrative access encrypted | No mapping in our data | — | No mapping to NIS2 in our data. |
| 2.3.2 | Wireless keys changed when key holders leave | No mapping in our data | — | No mapping to NIS2 in our data. |
| Requirement 3: Protect stored account data · 14 | ||||
| 3.3.1.1 | Full track data not kept after authorisation | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.3.1.2 | Card verification code not kept after authorisation | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.3.1.3 | PIN and PIN block not kept after authorisation | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.3.2 | Sensitive authentication data encrypted before authorisation | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.3.3 | Issuer storage of sensitive authentication data limited and protected | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.5.1.1 | Hashes of PAN are keyed cryptographic hashes | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.5.1.2 | Disk-level encryption used only where it suffices | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.7.2 | Key management: secure key distribution | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.7.3 | Key management: secure key storage | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.7.5 | Key management: retiring weakened or compromised keys | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.7.6 | Key management: split knowledge and dual control | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.7.7 | Key management: preventing unauthorised key substitution | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.7.8 | Key custodians formally acknowledge their responsibilities | No mapping in our data | — | No mapping to NIS2 in our data. |
| 3.7.9 | Service providers give customers key-handling guidance | No mapping in our data | — | No mapping to NIS2 in our data. |
| Requirement 4: Protect cardholder data with strong cryptography during transmission · 2 | ||||
| 4.2.1.2 | Strong cryptography on wireless networks carrying PAN | No mapping in our data | — | No mapping to NIS2 in our data. |
| 4.2.2 | PAN secured when sent by end-user messaging | No mapping in our data | — | No mapping to NIS2 in our data. |
| Requirement 5: Protect all systems and networks from malicious software · 4 | ||||
| 5.3.1 | Anti-malware kept up to date | No mapping in our data | — | No mapping to NIS2 in our data. |
| 5.3.3 | Removable media scanned or analysed | No mapping in our data | — | No mapping to NIS2 in our data. |
| 5.3.4 | Anti-malware audit logs enabled and retained | No mapping in our data | — | No mapping to NIS2 in our data. |
| 5.3.5 | Users cannot disable or alter anti-malware | No mapping in our data | — | No mapping to NIS2 in our data. |
| Requirement 6: Develop and maintain secure systems and software · 6 | ||||
| 6.5.1 | Production changes follow change control procedures | No mapping in our data | — | No mapping to NIS2 in our data. |
| 6.5.2 | PCI DSS requirements re-confirmed after significant changes | No mapping in our data | — | No mapping to NIS2 in our data. |
| 6.5.3 | Pre-production environments separated from production | No mapping in our data | — | No mapping to NIS2 in our data. |
| 6.5.4 | Duties separated between production and pre-production | No mapping in our data | — | No mapping to NIS2 in our data. |
| 6.5.5 | Live PANs not used in pre-production | No mapping in our data | — | No mapping to NIS2 in our data. |
| 6.5.6 | Test data and accounts removed before go-live | No mapping in our data | — | No mapping to NIS2 in our data. |
| Requirement 7: Restrict access to system components and cardholder data by business need to know · 6 | ||||
| 7.2.3 | Privileges approved by authorised personnel | No mapping in our data | — | No mapping to NIS2 in our data. |
| 7.2.5 | System and application accounts least privilege | No mapping in our data | — | No mapping to NIS2 in our data. |
| 7.2.6 | Access to cardholder data repositories restricted | No mapping in our data | — | No mapping to NIS2 in our data. |
| 7.3.1 | Access control system restricts access by need | No mapping in our data | — | No mapping to NIS2 in our data. |
| 7.3.2 | Access control system enforces assigned permissions | No mapping in our data | — | No mapping to NIS2 in our data. |
| 7.3.3 | Access control system set to deny by default | No mapping in our data | — | No mapping to NIS2 in our data. |
| Requirement 8: Identify users and authenticate access to system components · 10 | ||||
| 8.2.2 | Shared or generic accounts only by documented exception | No mapping in our data | — | No mapping to NIS2 in our data. |
| 8.2.3 | Service providers use unique credentials per customer | No mapping in our data | — | No mapping to NIS2 in our data. |
| 8.2.4 | User ID changes authorised and controlled | No mapping in our data | — | No mapping to NIS2 in our data. |
| 8.2.7 | Third-party remote access accounts enabled only when needed | No mapping in our data | — | No mapping to NIS2 in our data. |
| 8.3.2 | Authentication factors unreadable in transit and storage | No mapping in our data | — | No mapping to NIS2 in our data. |
| 8.3.3 | Identity verified before changing authentication factors | No mapping in our data | — | No mapping to NIS2 in our data. |
| 8.3.4 | Account lockout after repeated failed attempts | No mapping in our data | — | No mapping to NIS2 in our data. |
| 8.3.5 | First-use and reset passwords unique and changed | No mapping in our data | — | No mapping to NIS2 in our data. |
| 8.3.11 | Tokens, smart cards and certificates assigned to individuals | No mapping in our data | — | No mapping to NIS2 in our data. |
| 8.6.1 | Interactive use of system accounts managed | No mapping in our data | — | No mapping to NIS2 in our data. |
| Requirement 9: Restrict physical access to cardholder data · 10 | ||||
| 9.2.2 | Publicly accessible network jacks restricted | No mapping in our data | — | No mapping to NIS2 in our data. |
| 9.3.3 | Visitor badges returned or deactivated | No mapping in our data | — | No mapping to NIS2 in our data. |
| 9.3.4 | Visitor log maintained and retained | No mapping in our data | — | No mapping to NIS2 in our data. |
| 9.4.1 | Media with cardholder data physically secured | No mapping in our data | — | No mapping to NIS2 in our data. |
| 9.4.3 | Media sent off site tracked and secured | No mapping in our data | — | No mapping to NIS2 in our data. |
| 9.4.4 | Management approves media moved off site | No mapping in our data | — | No mapping to NIS2 in our data. |
| 9.4.5 | Inventory logs of electronic media kept | No mapping in our data | — | No mapping to NIS2 in our data. |
| 9.4.5.1 | Electronic media inventories at least annually | No mapping in our data | — | No mapping to NIS2 in our data. |
| 9.5.1 | Card-reading (POI) devices protected from tampering | No mapping in our data | — | No mapping to NIS2 in our data. |
| 9.5.1.3 | Staff trained to spot POI tampering | No mapping in our data | — | No mapping to NIS2 in our data. |
| Requirement 10: Log and monitor all access to system components and cardholder data · 12 | ||||
| 10.2.1.1 | Logs capture user access to cardholder data | No mapping in our data | — | No mapping to NIS2 in our data. |
| 10.2.1.2 | Logs capture administrative actions | No mapping in our data | — | No mapping to NIS2 in our data. |
| 10.2.1.3 | Logs capture access to audit logs | No mapping in our data | — | No mapping to NIS2 in our data. |
| 10.2.1.4 | Logs capture invalid access attempts | No mapping in our data | — | No mapping to NIS2 in our data. |
| 10.2.1.5 | Logs capture credential and privilege changes | No mapping in our data | — | No mapping to NIS2 in our data. |
| 10.2.1.6 | Logs capture starting, stopping or pausing logging | No mapping in our data | — | No mapping to NIS2 in our data. |
| 10.2.1.7 | Logs capture system-level object changes | No mapping in our data | — | No mapping to NIS2 in our data. |
| 10.4.2 | Other logs reviewed periodically | No mapping in our data | — | No mapping to NIS2 in our data. |
| 10.4.3 | Exceptions and anomalies addressed | No mapping in our data | — | No mapping to NIS2 in our data. |
| 10.6.2 | Time configuration correct and consistent | No mapping in our data | — | No mapping to NIS2 in our data. |
| 10.6.3 | Time settings protected from change | No mapping in our data | — | No mapping to NIS2 in our data. |
| 10.7.3 | Security control failures responded to promptly | No mapping in our data | — | No mapping to NIS2 in our data. |
| Requirement 11: Test security of systems and networks regularly · 12 | ||||
| 11.2.2 | Inventory of authorised wireless access points | No mapping in our data | — | No mapping to NIS2 in our data. |
| 11.3.1.2 | Internal scans use authenticated scanning | No mapping in our data | — | No mapping to NIS2 in our data. |
| 11.3.1.3 | Internal scans after significant changes | No mapping in our data | — | No mapping to NIS2 in our data. |
| 11.3.2.1 | External scans after significant changes | No mapping in our data | — | No mapping to NIS2 in our data. |
| 11.4.1 | Penetration testing methodology defined | No mapping in our data | — | No mapping to NIS2 in our data. |
| 11.4.2 | Internal penetration test at least annually | No mapping in our data | — | No mapping to NIS2 in our data. |
| 11.4.3 | External penetration test at least annually | No mapping in our data | — | No mapping to NIS2 in our data. |
| 11.4.5 | Segmentation controls tested at least annually | No mapping in our data | — | No mapping to NIS2 in our data. |
| 11.4.6 | Service providers test segmentation every six months | No mapping in our data | — | No mapping to NIS2 in our data. |
| 11.4.7 | Multi-tenant providers support customer penetration tests | No mapping in our data | — | No mapping to NIS2 in our data. |
| 11.5.1.1 | Service providers detect covert malware communication | No mapping in our data | — | No mapping to NIS2 in our data. |
| 11.5.2 | Change-detection on critical files | No mapping in our data | — | No mapping to NIS2 in our data. |
| Requirement 12: Support information security with organizational policies and programs · 6 | ||||
| 12.2.1 | Acceptable use policies for end-user technologies | No mapping in our data | — | No mapping to NIS2 in our data. |
| 12.4.1 | Service providers: executive responsibility for PCI DSS compliance | No mapping in our data | — | No mapping to NIS2 in our data. |
| 12.5.2.1 | Service providers confirm scope every six months | No mapping in our data | — | No mapping to NIS2 in our data. |
| 12.6.2 | Awareness programme reviewed annually | No mapping in our data | — | No mapping to NIS2 in our data. |
| 12.6.3.1 | Training covers phishing and social engineering | No mapping in our data | — | No mapping to NIS2 in our data. |
| 12.6.3.2 | Training covers acceptable use of technology | No mapping in our data | — | No mapping to NIS2 in our data. |
| Appendix A: additional requirements · 10 | ||||
| A1.1.1 | Multi-tenant providers: separate provider and customer environments | No mapping in our data | — | No mapping to NIS2 in our data. |
| A1.1.2 | Multi-tenant providers: customers confined to their own environment | No mapping in our data | — | No mapping to NIS2 in our data. |
| A1.1.3 | Multi-tenant providers: customers reach only their own data | No mapping in our data | — | No mapping to NIS2 in our data. |
| A1.1.4 | Multi-tenant providers: separation tested every six months | No mapping in our data | — | No mapping to NIS2 in our data. |
| A1.2.1 | Multi-tenant providers: audit logging for each customer | No mapping in our data | — | No mapping to NIS2 in our data. |
| A1.2.2 | Multi-tenant providers: support customer forensic investigations | No mapping in our data | — | No mapping to NIS2 in our data. |
| A1.2.3 | Multi-tenant providers: report suspected incidents to customers | No mapping in our data | — | No mapping to NIS2 in our data. |
| A2.1.1 | POI terminals using SSL or early TLS not exploitable | No mapping in our data | — | No mapping to NIS2 in our data. |
| A2.1.2 | Service providers: migration plan off SSL and early TLS | No mapping in our data | — | No mapping to NIS2 in our data. |
| A2.1.3 | Service providers offer a secure connection option | No mapping in our data | — | No mapping to NIS2 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (78)
| PCI DSS | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| Requirement 1: Install and maintain network security controls · 3 | ||||
| 1.1.1 | Network security policies documented and kept current | 1.16.1 | Only shares CSF GV.PO-02: related, not a mapping | |
| 1.1.2 | Roles for network security controls assigned | 1.2 | Only shares CSF GV.RR-02: related, not a mapping | |
| 1.2.4 | Accurate account-data flow diagram maintained | 5.14.34.1+5 | Only shares CSF GV.OC-05, GV.SC-01, GV.SC-04, GV.SC-06…: related, not a mapping | |
| Requirement 2: Apply secure configurations to all system components · 3 | ||||
| 2.1.1 | Secure configuration policies documented and kept current | 1.16.1 | Only shares CSF GV.PO-02: related, not a mapping | |
| 2.1.2 | Roles for secure configuration assigned | 1.2 | Only shares CSF GV.RR-02: related, not a mapping | |
| 2.3.1 | Wireless vendor defaults changed | 9.111.611.7 | Only shares CSF PR.DS-02, PR.AA-03: related, not a mapping | |
| Requirement 3: Protect stored account data · 7 | ||||
| 3.1.1 | Stored account data policies documented and kept current | 1.16.1 | Only shares CSF GV.PO-02: related, not a mapping | |
| 3.1.2 | Roles for protecting stored account data assigned | 1.2 | Only shares CSF GV.RR-02: related, not a mapping | |
| 3.5.1.3 | Disk encryption access managed separately from OS access | 9.111.611.7+1 | Only shares CSF PR.DS-01, PR.AA-03: related, not a mapping | |
| 3.6.1.1 | Service providers document their cryptographic architecture | 9.111.512.3 | Only shares CSF PR.DS-01, PR.AA-01: related, not a mapping | |
| 3.6.1.2 | Secret and private keys stored in approved forms | 9.111.512.3 | Only shares CSF PR.DS-01, PR.AA-01: related, not a mapping | |
| 3.6.1.3 | Cleartext key components accessible to fewest custodians | 9.111.512.3 | Only shares CSF PR.DS-01, PR.AA-01: related, not a mapping | |
| 3.6.1.4 | Keys stored in the fewest possible locations | 9.111.512.3 | Only shares CSF PR.DS-01, PR.AA-01: related, not a mapping | |
| Requirement 4: Protect cardholder data with strong cryptography during transmission · 2 | ||||
| 4.1.1 | Data-in-transit policies documented and kept current | 1.16.1 | Only shares CSF GV.PO-02: related, not a mapping | |
| 4.1.2 | Roles for protecting data in transit assigned | 1.2 | Only shares CSF GV.RR-02: related, not a mapping | |
| Requirement 5: Protect all systems and networks from malicious software · 5 | ||||
| 5.1.1 | Anti-malware policies documented and kept current | 1.16.1 | Only shares CSF GV.PO-02: related, not a mapping | |
| 5.1.2 | Roles for malware protection assigned | 1.2 | Only shares CSF GV.RR-02: related, not a mapping | |
| 5.2.3 | Systems without anti-malware periodically re-evaluated | 6.76.8 | Only shares CSF PR.IR-01: related, not a mapping | |
| 5.2.3.1 | Re-evaluation frequency set by targeted risk analysis | 2.11.16.7+2 | Only shares CSF GV.RM-03, GV.RM-06, PR.IR-01: related, not a mapping | |
| 5.3.2.1 | Scan frequency set by targeted risk analysis | 2.11.17.1 | Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping | |
| Requirement 6: Develop and maintain secure systems and software · 7 | ||||
| 6.1.1 | Secure systems and software policies documented | 1.16.1 | Only shares CSF GV.PO-02: related, not a mapping | |
| 6.1.2 | Roles for secure systems and software assigned | 1.2 | Only shares CSF GV.RR-02: related, not a mapping | |
| 6.2.3.1 | Manual code reviews approved by someone else | 6.212.4 | Only shares CSF ID.AM-08: related, not a mapping | |
| 6.2.4 | Coding techniques prevent common software attacks | 6.212.46.7+3 | Only shares CSF ID.AM-08, PR.PS-06, PR.IR-01: related, not a mapping | |
| 6.4.1 | Public web applications protected against attacks | 6.26.76.8 | Only shares CSF PR.PS-06, PR.IR-01: related, not a mapping | |
| 6.4.2 | Automated solution blocks attacks on public web apps | 6.74.36.8+1 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| 6.4.3 | Payment page scripts authorised and integrity-checked | 5.16.76.9+5 | Only shares CSF GV.SC-01, GV.SC-07, GV.SC-09, GV.SC-10…: related, not a mapping | |
| Requirement 7: Restrict access to system components and cardholder data by business need to know · 3 | ||||
| 7.1.1 | Access restriction policies documented and kept current | 1.16.111.1+4 | Only shares CSF GV.PO-02, PR.AA-05: related, not a mapping | |
| 7.1.2 | Roles for access restriction assigned | 1.2 | Only shares CSF GV.RR-02: related, not a mapping | |
| 7.2.5.1 | System and application account access periodically reviewed | 2.11.17.1+5 | Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping | |
| Requirement 8: Identify users and authenticate access to system components · 13 | ||||
| 8.1.1 | Identification and authentication policies documented | 1.16.111.1+4 | Only shares CSF GV.PO-02, PR.AA-05: related, not a mapping | |
| 8.1.2 | Roles for identification and authentication assigned | 1.2 | Only shares CSF GV.RR-02: related, not a mapping | |
| 8.2.5 | Access revoked immediately on termination | 5.110.110.2+1 | Only shares CSF GV.SC-10, GV.RR-04: related, not a mapping | |
| 8.2.6 | Inactive user accounts disabled within 90 days | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| 8.2.8 | Re-authentication after 15 minutes idle | 11.611.7 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.6 | Minimum password length and complexity | 11.611.7 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.7 | Recent passwords cannot be reused | 11.611.7 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.8 | Authentication guidance communicated to users | 11.611.7 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.9 | Password-only access: change every 90 days or analyse risk | 11.611.7 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.10 | Service providers give customers password guidance | 11.611.7 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.3.10.1 | Service provider customer passwords: rotation or analysis | 11.611.7 | Only shares CSF PR.AA-03: related, not a mapping | |
| 8.6.2 | No hard-coded passwords for system accounts | 11.5 | Only shares CSF PR.AA-01: related, not a mapping | |
| 8.6.3 | System account passwords protected and changed | 2.11.16.4+2 | Only shares CSF GV.RM-03, GV.RM-06, ID.RA-07: related, not a mapping | |
| Requirement 9: Restrict physical access to cardholder data · 9 | ||||
| 9.1.1 | Physical security policies documented and kept current | 1.16.113.2 | Only shares CSF GV.PO-02, PR.IR-02: related, not a mapping | |
| 9.1.2 | Roles for physical security assigned | 1.213.2 | Only shares CSF GV.RR-02, PR.IR-02: related, not a mapping | |
| 9.2.4 | Consoles in sensitive areas locked when unattended | 11.511.611.7+1 | Only shares CSF PR.AA-06, PR.AA-03: related, not a mapping | |
| 9.4.1.2 | Security of offline backup location reviewed annually | 4.213.113.3 | Only shares CSF PR.DS-11, DE.CM-02: related, not a mapping | |
| 9.4.6 | Hard-copy media destroyed when no longer needed | 5.11.19.1+3 | Only shares CSF GV.OC-03, GV.SC-10, PR.DS-01: related, not a mapping | |
| 9.4.7 | Electronic media destroyed or made unrecoverable | 5.11.14.2+5 | Only shares CSF GV.OC-03, GV.SC-10, PR.DS-11: related, not a mapping | |
| 9.5.1.1 | Inventory of POI devices kept | 5.16.16.10+2 | Only shares CSF GV.SC-09, ID.RA-09, PR.PS-03: related, not a mapping | |
| 9.5.1.2 | POI devices inspected for tampering | 13.35.111.5+2 | Only shares CSF DE.CM-02, PR.AA-06, GV.SC-09: related, not a mapping | |
| 9.5.1.2.1 | Inspection frequency set by targeted risk analysis | 2.11.15.1+3 | Only shares CSF GV.RM-03, GV.RM-06, GV.SC-09: related, not a mapping | |
| Requirement 10: Log and monitor all access to system components and cardholder data · 9 | ||||
| 10.1.1 | Logging and monitoring policies documented | 1.16.1 | Only shares CSF GV.PO-02: related, not a mapping | |
| 10.1.2 | Roles for logging and monitoring assigned | 1.2 | Only shares CSF GV.RR-02: related, not a mapping | |
| 10.2.2 | Log entries record who, what, when, where and outcome | 3.23.5 | Only shares CSF RS.AN-07, RS.AN-03: related, not a mapping | |
| 10.3.1 | Read access to logs limited to need | 3.24.3 | Only shares CSF RS.AN-06, DE.AE-06: related, not a mapping | |
| 10.3.3 | Logs promptly backed up to a central server | 4.33.2 | Only shares CSF DE.AE-02, DE.AE-03, DE.AE-06, RS.AN-06…: related, not a mapping | |
| 10.3.4 | File-integrity monitoring on logs | 3.24.36.6+1 | Only shares CSF RS.AN-06, DE.AE-02, DE.CM-09: related, not a mapping | |
| 10.4.2.1 | Review frequency set by targeted risk analysis | 2.11.14.3+3 | Only shares CSF GV.RM-03, GV.RM-06, DE.AE-02: related, not a mapping | |
| 10.7.1 | Service providers detect security control failures | 2.22.3 | Only shares CSF GV.OV-02: related, not a mapping | |
| 10.7.2 | Critical security control failures detected and reported | 2.32.2 | Only shares CSF GV.OV-02, GV.OV-03: related, not a mapping | |
| Requirement 11: Test security of systems and networks regularly · 6 | ||||
| 11.1.1 | Security testing policies documented and kept current | 1.16.1 | Only shares CSF GV.PO-02: related, not a mapping | |
| 11.1.2 | Roles for security testing assigned | 1.2 | Only shares CSF GV.RR-02: related, not a mapping | |
| 11.2.1 | Wireless access points detected and unauthorised ones handled | 6.74.36.8+1 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| 11.3.1.1 | Lower-ranked vulnerabilities handled by risk analysis | 2.11.16.10+1 | Only shares CSF GV.RM-03, GV.RM-06, ID.RA-05: related, not a mapping | |
| 11.4.4 | Penetration test findings corrected and retested | 2.32.12.2+3 | Only shares CSF GV.OV-02, GV.OV-03, ID.RA-01: related, not a mapping | |
| 11.6.1 | Payment page changes and tampering detected | 5.12.11.1+4 | Only shares CSF GV.SC-01, GV.SC-07, GV.SC-09, GV.RM-03…: related, not a mapping | |
| Requirement 12: Support information security with organizational policies and programs · 11 | ||||
| 12.3.2 | Targeted risk analysis for customised approach | 2.16.47.1 | Only shares CSF GV.RM-06, ID.RA-07: related, not a mapping | |
| 12.3.3 | Cipher suites and protocols reviewed annually | 2.11.17.1+1 | Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping | |
| 12.3.4 | Hardware and software technologies reviewed annually | 2.12.35.1+5 | Only shares CSF GV.RM-03, GV.RM-06, GV.OV-02, GV.OV-03…: related, not a mapping | |
| 12.4.2.1 | Service providers: quarterly review results documented | 2.22.3 | Only shares CSF GV.OV-02: related, not a mapping | |
| 12.5.2 | PCI DSS scope confirmed annually and on change | 5.15.212.4+5 | Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping | |
| 12.5.3 | Service providers review scope after organisational change | 1.12.12.2+1 | Only shares CSF GV.RM-03, GV.OV-02: related, not a mapping | |
| 12.9.1 | Service providers acknowledge responsibilities to customers | 5.11.113.1+4 | Only shares CSF GV.OC-03, GV.OC-05, GV.SC-01, GV.SC-05…: related, not a mapping | |
| 12.9.2 | Service providers support customer compliance requests | 5.11.113.1+2 | Only shares CSF GV.OC-03, GV.OC-05, GV.SC-01, GV.SC-05…: related, not a mapping | |
| 12.10.4.1 | Training frequency set by targeted risk analysis | 1.12.11.2+3 | Only shares CSF GV.RM-03, PR.AT-02, GV.RM-06: related, not a mapping | |
| 12.10.5 | Plan covers alerts from security monitoring | 3.14.1 | Only shares CSF GV.SC-08: related, not a mapping | |
| 12.10.7 | Procedures for PAN found where it shouldn't be | 12.4 | Only shares CSF ID.AM-07: related, not a mapping | |
Mapped (72)
| PCI DSS | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| Requirement 1: Install and maintain network security controls · 4 | ||||
| 1.2.1 | Configuration standards for network security controls | Editorial | 6.76.8 | Same topic: Firewall / Net Seg (editorial pick) |
| 1.2.3 | Accurate network diagram maintained | Crosswalk | 6.76.8 | Same topic: Firewall / Net Seg |
| 1.3.1 | Inbound traffic to the CDE restricted | Editorial | 6.76.8 | Same topic: Firewall / Net Seg (editorial pick) |
| 1.4.1 | Network controls between trusted and untrusted networks | Editorial | 6.76.8 | Same topic: Firewall / Net Seg (editorial pick) |
| Requirement 2: Apply secure configurations to all system components · 2 | ||||
| 2.2.1 | System configuration standards developed and maintained | Crosswalk | 6.3 | Same topic: Secure Config |
| 2.2.2 | Vendor default accounts managed or removed | Crosswalk | 6.3 | Same topic: Secure Config |
| Requirement 3: Protect stored account data · 8 | ||||
| 3.2.1 | Account data storage minimised, with retention and disposal | Crosswalk | 12.212.3 | Same topic: Data Protection |
| 3.3.1 | Sensitive authentication data not kept after authorisation | Crosswalk | 12.212.3 | Same topic: Data Protection |
| 3.4.1 | PAN masked when displayed | Crosswalk | 12.212.3 | Same topic: Data Protection |
| 3.4.2 | PAN copying prevented over remote-access technologies | Editorial | 12.3 | Same topic: DLP (editorial pick) |
| 3.5.1 | PAN rendered unreadable wherever stored | Crosswalk | 9.1 | Same topic: Encryption |
| 3.6.1 | Procedures protect keys that secure stored account data | Crosswalk | 9.1 | Same topic: Encryption |
| 3.7.1 | Key management: strong key generation | Editorial | 9.1 | Same topic: Encryption (editorial pick) |
| 3.7.4 | Key management: key changes at end of cryptoperiod | Editorial | 9.1 | Same topic: Encryption (editorial pick) |
| Requirement 4: Protect cardholder data with strong cryptography during transmission · 2 | ||||
| 4.2.1 | Strong cryptography for PAN over open, public networks | Crosswalk | 9.1 | Same topic: Encryption |
| 4.2.1.1 | Inventory of trusted keys and certificates kept | Editorial | 9.1 | Same topic: Encryption (editorial pick) |
| Requirement 5: Protect all systems and networks from malicious software · 4 | ||||
| 5.2.1 | Anti-malware deployed on system components | Crosswalk | 6.9 | Same topic: Endpoint Protection |
| 5.2.2 | Anti-malware detects, removes or contains known malware | Crosswalk | 6.9 | Same topic: Endpoint Protection |
| 5.3.2 | Periodic scans or continuous behavioural analysis | Crosswalk | 6.9 | Same topic: Endpoint Protection |
| 5.4.1 | Mechanisms to detect and protect against phishing | Editorial | 6.9 | Same topic: Email Security (editorial pick) |
| Requirement 6: Develop and maintain secure systems and software · 6 | ||||
| 6.2.1 | Bespoke and custom software developed securely | Editorial | 6.2 | Same topic: Secure Development (editorial pick) |
| 6.2.2 | Developers trained in secure software development | Crosswalk | 6.2 | Same topic: Secure Development |
| 6.2.3 | Custom code reviewed before release | Crosswalk | 6.2 | Same topic: Secure Development |
| 6.3.1 | Vulnerabilities identified and risk-ranked | Crosswalk | 6.56.66.10 | Same topic: Vulnerability Mgmt, Patch Management |
| 6.3.2 | Inventory of custom software and its components | Crosswalk | 5.16.112.4 | Same topic: Supply Chain Risk, Asset Management |
| 6.3.3 | Security patches installed promptly | Crosswalk | 6.6 | Same topic: Patch Management |
| Requirement 7: Restrict access to system components and cardholder data by business need to know · 3 | ||||
| 7.2.1 | Access control model defined | Crosswalk | 6.811.111.2+2 | Same topic: Zero Trust, Access Control |
| 7.2.2 | Access assigned by job function and least privilege | Crosswalk | 11.111.211.3+2 | Same topic: Access Control, Privileged Access |
| 7.2.4 | User accounts and privileges reviewed every six months | Crosswalk | 11.111.211.5 | Same topic: Access Control |
| Requirement 8: Identify users and authenticate access to system components · 6 | ||||
| 8.2.1 | Every user has a unique ID | Crosswalk | 11.111.211.5 | Same topic: Access Control |
| 8.3.1 | User and admin access requires an authentication factor | Crosswalk | 6.811.111.6 | Same topic: Zero Trust |
| 8.4.1 | MFA for non-console administrative access to the CDE | Editorial | 11.611.7 | Same topic: Multi-Factor Auth (editorial pick) |
| 8.4.2 | MFA for all access into the CDE | Editorial | 11.611.7 | Same topic: Multi-Factor Auth (editorial pick) |
| 8.4.3 | MFA for remote network access | Editorial | 11.611.7 | Same topic: Multi-Factor Auth (editorial pick) |
| 8.5.1 | MFA systems configured to resist misuse | Editorial | 11.611.7 | Same topic: Multi-Factor Auth (editorial pick) |
| Requirement 9: Restrict physical access to cardholder data · 8 | ||||
| 9.2.1 | Facility entry controls restrict CDE access | Editorial | 13.113.213.3 | Same topic: Physical Security (editorial pick) |
| 9.2.1.1 | Access to sensitive areas monitored by camera or access control | Editorial | 13.113.213.3 | Same topic: Physical Security (editorial pick) |
| 9.2.3 | Physical access to network hardware restricted | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| 9.3.1 | Personnel physical access authorised and managed | Editorial | 13.113.213.3 | Same topic: Physical Security (editorial pick) |
| 9.3.1.1 | Sensitive-area access authorised and revoked promptly | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| 9.3.2 | Visitor access authorised, escorted and identifiable | Editorial | 13.113.213.3 | Same topic: Physical Security (editorial pick) |
| 9.4.1.1 | Offline backup media stored securely | Crosswalk | 4.2 | Same topic: Backup & Recovery |
| 9.4.2 | Media classified by data sensitivity | Editorial | 12.1 | Same topic: Data Classification (editorial pick) |
| Requirement 10: Log and monitor all access to system components and cardholder data · 6 | ||||
| 10.2.1 | Audit logs enabled and active | Crosswalk | 3.210.210.4 | Same topic: Logging & Audit, Insider Threat |
| 10.3.2 | Logs protected from modification | Crosswalk | 3.23.5 | Same topic: Logging & Audit, Forensics |
| 10.4.1 | Security event and critical logs reviewed daily | Crosswalk | 3.23.4 | Same topic: Cont. Monitoring, SIEM / SOC |
| 10.4.1.1 | Automated mechanisms for log review | Editorial | 3.4 | Same topic: Anomaly Detection (editorial pick) |
| 10.5.1 | Audit logs retained 12 months, three immediately available | Editorial | 3.2 | Same topic: Logging & Audit (editorial pick) |
| 10.6.1 | System clocks synchronised | Crosswalk | 3.2 | Same topic: Logging & Audit |
| Requirement 11: Test security of systems and networks regularly · 3 | ||||
| 11.3.1 | Internal vulnerability scans every three months | Crosswalk | 6.56.10 | Same topic: Vulnerability Mgmt |
| 11.3.2 | External ASV scans every three months | Crosswalk | 6.56.10 | Same topic: Vulnerability Mgmt |
| 11.5.1 | Intrusion detection or prevention on network traffic | Editorial | 3.2 | Same topic: Intrusion Detection (editorial pick) |
| Requirement 12: Support information security with organizational policies and programs · 20 | ||||
| 12.1.1 | Information security policy established and published | Crosswalk | 1.1 | Same topic: Governance Policy |
| 12.1.2 | Security policy reviewed at least annually | Crosswalk | 1.1 | Same topic: Governance Policy |
| 12.1.3 | Security roles and responsibilities defined | Crosswalk | 1.2 | Same topic: Roles & Responsibilities |
| 12.1.4 | Executive responsibility for information security assigned | Crosswalk | 1.2 | Same topic: Roles & Responsibilities |
| 12.3.1 | Targeted risk analysis for flexible-frequency requirements | Crosswalk | 2.17.1 | Same topic: Risk Management, Risk Assessment |
| 12.4.2 | Service providers: quarterly reviews of operational tasks | Crosswalk | 2.22.3 | Same topic: Compliance |
| 12.5.1 | Inventory of in-scope system components | Crosswalk | 12.4 | Same topic: Asset Management |
| 12.6.1 | Formal security awareness programme | Crosswalk | 8.18.2 | Same topic: Awareness & Training |
| 12.6.3 | Awareness training on hire and at least annually | Crosswalk | 8.18.2 | Same topic: Awareness & Training |
| 12.7.1 | Personnel screened before hire | Crosswalk | 10.210.4 | Same topic: Insider Threat |
| 12.8.1 | List of third-party service providers kept | Crosswalk | 5.15.26.1 | Same topic: Supply Chain Risk, Vendor Risk Mgmt, Cloud Security |
| 12.8.2 | Written agreements with service providers | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| 12.8.3 | Due diligence before engaging service providers | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| 12.8.4 | Service provider compliance monitored annually | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| 12.8.5 | Responsibilities split with each provider documented | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt, Cloud Security |
| 12.10.1 | Incident response plan ready to activate | Crosswalk | 3.13.33.5+3 | Same topic: Incident Response, Reporting, Mitigation |
| 12.10.2 | Incident response plan reviewed and tested annually | Crosswalk | 3.13.5 | Same topic: Incident Response |
| 12.10.3 | Incident response staff available around the clock | Crosswalk | 3.13.5 | Same topic: Incident Response |
| 12.10.4 | Incident response staff trained | Crosswalk | 3.13.5 | Same topic: Incident Response |
| 12.10.6 | Plan updated from lessons learned and industry changes | Crosswalk | 3.6 | Same topic: Lessons Learned |
By topic
Both cover (41):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentData ClassificationVulnerability MgmtAccess ControlMulti-Factor AuthEncryptionData ProtectionBackup & RecoveryPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigSecure DevelopmentEmail SecurityZero TrustCloud SecurityDLPCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsMitigationReportingRecovery PlanningBusiness ContinuityLessons LearnedDisaster RecoveryInsider ThreatVendor Risk MgmtPhysical Security
Only PCI DSS (5):
Only NIS2 (2):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.