PCI DSS · Requirement 1: Install and maintain network security controls
1.2.3
Accurate network diagram maintained
frameworkPCI DSS v4.0.1
sectionRequirement 1: Install and maintain network security controls
csf 2.0DE.AE-04 GV.OC-05 GV.SC-01 GV.SC-06 GV.SC-08 GV.SC-10 ID.AM-01 ID.AM-03 PR.IR-01 RC.RP-02 RC.RP-04 RS.AN-08
topicsFirewall / Net Seg
frameworks6 3 0
Official text · not licensableSummary (ControlMapping's wording): Accurate network diagram maintained. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-03PR.IR-01 | Representations of the organization's authorized network communication and internal and external network data flows are maintained; Networks and environments are protected from unauthorized logical access and usage | Crosswalk | Same topic: Firewall / Net Seg10 loosely related (not mappings)DE.AE-04 The estimated impact and scope of adverse events are understood Only shares CSF DE.AE-04: related, not a mapping GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated Only shares CSF GV.OC-05: related, not a mapping GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders Only shares CSF GV.SC-01: related, not a mapping GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships Only shares CSF GV.SC-06: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Only shares CSF GV.SC-08: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Only shares CSF GV.SC-10: related, not a mapping ID.AM-01 Inventories of hardware managed by the organization are maintained Only shares CSF ID.AM-01: related, not a mapping RC.RP-02 Recovery actions are selected, scoped, prioritized, and performed Only shares CSF RC.RP-02: related, not a mapping …and 2 more in the downloads |
| ISO 27001 | A.8.20A.8.21A.8.22 | Networks security; Security of network services… | Crosswalk | Same topic: Firewall / Net Seg19 loosely related (not mappings)A.5.19 Information security in supplier relationships Only shares CSF GV.SC-01, GV.SC-06, GV.SC-10: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.SC-01, GV.SC-06, GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Only shares CSF GV.SC-01, GV.SC-10: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Only shares CSF GV.SC-01, GV.SC-10: related, not a mapping A.5.25 Assessment and decision on information security events Only shares CSF DE.AE-04, RS.AN-08: related, not a mapping A.5.26 Response to information security incidents Only shares CSF GV.SC-08, RC.RP-02: related, not a mapping Clause 8.1 Operational planning and control Only shares CSF GV.SC-01, RC.RP-04: related, not a mapping …and 11 more in the downloads |
| CIS v8.1 | CIS 12.2CIS 4.4CIS 4.5CIS 12.3CIS 12.4CIS 12.6CIS 13.4CIS 13.9 | Establish and Maintain a Secure Network Architecture; Implement and Manage a Firewall on Servers… | Crosswalk | Same topic: Firewall / Net Seg24 loosely related (not mappings)CIS 15.4 Ensure Service Provider Contracts Include Security Requirements Only shares CSF GV.SC-06, GV.SC-08: related, not a mapping CIS 15.7 Securely Decommission Service Providers Only shares CSF GV.SC-06, GV.SC-10: related, not a mapping CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Only shares CSF ID.AM-01: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Only shares CSF PR.IR-01: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Only shares CSF GV.SC-01: related, not a mapping …and 16 more in the downloads |
| SOC 2 | CC6.6 | Protection against threats from outside system boundaries | Editorial | Same topic: Firewall / Net Seg (editorial pick)9 loosely related (not mappings)CC9.2 Managing vendor and business partner risk Only shares CSF GV.SC-01, GV.SC-06, PR.IR-01: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping A1.1 Capacity management to meet availability commitments Only shares CSF RC.RP-04: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Only shares CSF GV.OC-05: related, not a mapping CC6.1 Logical access security over information assets Only shares CSF ID.AM-01: related, not a mapping CC7.5 Recovering from identified security incidents Only shares CSF RC.RP-02: related, not a mapping …and 1 more in the downloads |
| CMMC | SC.L2-3.13.1SC.L2-3.13.5SC.L2-3.13.6 | Boundary Protection; Public-Access System Separation… | Crosswalk | Same topic: Firewall / Net Seg11 loosely related (not mappings)…and 3 more in the downloads |
| 800-53 | AC-4SC-7 | Information Flow Enforcement; Boundary Protection | Crosswalk | Same topic: Firewall / Net Seg35 loosely related (not mappings)SA-9 External System Services Only shares CSF GV.OC-05, GV.SC-06, GV.SC-08, GV.SC-10: related, not a mapping PM-11 Mission and Business Process Definition Only shares CSF DE.AE-04, GV.OC-05, RC.RP-04: related, not a mapping PM-30 Supply Chain Risk Management Strategy Only shares CSF DE.AE-04, GV.OC-05, GV.SC-01: related, not a mapping SR-2 Supply Chain Risk Management Plan Only shares CSF GV.SC-01, GV.SC-08, GV.SC-10: related, not a mapping SR-3 Supply Chain Controls and Processes Only shares CSF GV.SC-01, GV.SC-08, GV.SC-10: related, not a mapping …and 27 more in the downloads |
| HIPAA | §164.308(b)(1)§164.308(b)(4)§164.314(a)(2)(ii)§164.308(a)(6) | Business Associate Contracts and Other Arrangements; Written Contract or Other Arrangement… | No mapping. Only shares CSF GV.OC-05, GV.SC-06, GV.SC-08, GV.SC-10…: related, not a mapping+29 more loosely related (not mappings)§164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF GV.OC-05, GV.SC-06, GV.SC-08, GV.SC-10: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF GV.OC-05, GV.SC-06, GV.SC-08, GV.SC-10: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF GV.OC-05, GV.SC-06, GV.SC-08, GV.SC-10: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF GV.OC-05, GV.SC-06, GV.SC-08, GV.SC-10: related, not a mapping …and 25 more in the downloads | |
| GDPR | Art.28(1)Art.28(3)Art.30(1)Art.32(1)(b) | Processor; Processor… | No mapping. Only shares CSF GV.SC-01, GV.SC-06, PR.IR-01, ID.AM-01…: related, not a mapping+1 more loosely related (not mappings) | |
| NIS2 | 6.76.8 | Network security; Network segmentation | Crosswalk | Same topic: Firewall / Net Seg |
| Essential Eight | ISM-1228ISM-1515ISM-1807 | Cyber security events are analysed in a timely manner to identify cyber security incidents; Restoration of data, applications and settings from backups to a common point in time…… | No mapping. Only shares CSF DE.AE-04, RC.RP-02, ID.AM-01: related, not a mapping | |
| DORA | Art.9(4)(b) | Protection and prevention | Editorial | Same topic: Firewall / Net Seg (editorial pick)20 loosely related (not mappings)…and 12 more in the downloads |
| CPS 234 | Para 16Para 22Para 20Para 28 | Assess third parties' information security capability; Evaluate the design of third parties' controls… | No mapping. Only shares CSF GV.SC-01, GV.SC-06, ID.AM-01: related, not a mapping+1 more loosely related (not mappings)Para 34 Internal audit assesses third-party assurance relied on Only shares CSF GV.SC-06: related, not a mapping | |
| Cyber Essentials | CE 1 | Firewalls | Editorial | Same topic: Firewall / Net Seg (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.