PCI DSS · Requirement 1: Install and maintain network security controls

Accurate account-data flow diagram maintained

frameworkPCI DSS v4.0.1 sectionRequirement 1: Install and maintain network security controls csf 2.0DE.AE-03 DE.AE-04 DE.CM-01 GV.OC-05 GV.SC-01 GV.SC-04 GV.SC-06 GV.SC-07 GV.SC-08 GV.SC-10 ID.AM-03 PR.IR-01 RC.RP-02 RC.RP-04 RS.AN-08 topics— frameworks0 0 0

Official text · not licensableSummary (ControlMapping's wording): Accurate account-data flow diagram maintained. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 1.2.4 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.AE-03 DE.AE-04 DE.CM-01 GV.OC-05	Information is correlated from multiple sources; The estimated impact and scope of adverse events are understood…	Loosely related	No mapping. Only shares CSF DE.AE-03, DE.AE-04, DE.CM-01, GV.OC-05: related, not a mapping +11 more loosely related (not mappings) GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders Loosely related Only shares CSF GV.SC-01: related, not a mapping GV.SC-04 Suppliers are known and prioritized by criticality Loosely related Only shares CSF GV.SC-04: related, not a mapping GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships Loosely related Only shares CSF GV.SC-06: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Loosely related Only shares CSF GV.SC-07: related, not a mapping …and 7 more in the downloads
ISO 27001	A.5.19 A.5.20 A.5.22 Clause 6.1.1	Information security in supplier relationships; Addressing information security within supplier agreements…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping +19 more loosely related (not mappings) Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-01, GV.SC-10: related, not a mapping A.5.25 Assessment and decision on information security events Loosely related Only shares CSF DE.AE-04, RS.AN-08: related, not a mapping …and 15 more in the downloads
CIS v8.1	CIS 15.4 CIS 15.7 CIS 13.1 CIS 3.8	Ensure Service Provider Contracts Include Security Requirements; Securely Decommission Service Providers…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, GV.SC-08…: related, not a mapping +40 more loosely related (not mappings) CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 12.2 Establish and Maintain a Secure Network Architecture Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 15.1 Establish and Maintain an Inventory of Service Providers Loosely related Only shares CSF GV.SC-04: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF GV.SC-01: related, not a mapping …and 36 more in the downloads
SOC 2	CC9.2 CC6.6 CC7.2 A1.2	Managing vendor and business partner risk; Protection against threats from outside system boundaries…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping +6 more loosely related (not mappings) A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF RC.RP-04: related, not a mapping A1.3 Testing recovery plan procedures Loosely related Only shares CSF RC.RP-02: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-05: related, not a mapping CC7.3 Evaluating security events to determine if they are incidents Loosely related Only shares CSF DE.AE-03: related, not a mapping …and 2 more in the downloads
CMMC	RA.L2-3.11.1 IR.L2-3.6.1 CA.L2-3.12.3 CM.L2-3.4.9	Risk Assessments; Incident Handling…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, GV.SC-10…: related, not a mapping +19 more loosely related (not mappings) IR.L2-3.6.2 Incident Reporting Loosely related Only shares CSF DE.AE-03, GV.SC-08: related, not a mapping SC.L2-3.13.1 Boundary Protection Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping …and 15 more in the downloads
800-53	SA-9 IR-8 SA-4 SR-3	External System Services; Incident Response Plan…	Loosely related	No mapping. Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping +41 more loosely related (not mappings) SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, GV.SC-10: related, not a mapping IR-4 Incident Handling Loosely related Only shares CSF DE.AE-03, RC.RP-02, RS.AN-08: related, not a mapping PM-11 Mission and Business Process Definition Loosely related Only shares CSF DE.AE-04, GV.OC-05, RC.RP-04: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF DE.AE-04, GV.OC-05, GV.SC-01: related, not a mapping …and 37 more in the downloads
HIPAA	§164.308(b)(1)§164.308(b)(4)§164.314(a)(2)(ii)§164.314(a)	Business Associate Contracts and Other Arrangements; Written Contract or Other Arrangement…	Loosely related	No mapping. Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping +34 more loosely related (not mappings) §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF DE.AE-03, GV.SC-08, RC.RP-02, RC.RP-04…: related, not a mapping …and 30 more in the downloads
GDPR	Art.28(1)Art.28(3)Art.32(1)(b)Art.32(1)(c)	Processor; Processor…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping
NIS2	5.1 4.3 4.1 5.2	Supply chain security policy; Crisis management…	Loosely related	No mapping. Only shares CSF GV.OC-05, GV.SC-01, GV.SC-04, GV.SC-06…: related, not a mapping +10 more loosely related (not mappings) 6.7 Network security Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 3.1 Incident handling policy Loosely related Only shares CSF GV.SC-08: related, not a mapping 3.4 Event assessment and classification Loosely related Only shares CSF DE.AE-04: related, not a mapping 3.6 Post-incident reviews Loosely related Only shares CSF RS.AN-08: related, not a mapping …and 6 more in the downloads
Essential Eight	ISM-0109 ISM-1228 ISM-1906 ISM-1907	Event logs from workstations are analysed in a timely manner to detect cyber security…; Cyber security events are analysed in a timely manner to identify cyber security incidents…	Loosely related	No mapping. Only shares CSF DE.AE-03, DE.CM-01, DE.AE-04: related, not a mapping +6 more loosely related (not mappings) ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF DE.AE-03: related, not a mapping ISM-1515 Restoration of data, applications and settings from backups to a common point in time… Loosely related Only shares CSF RC.RP-02: related, not a mapping ISM-1623 PowerShell module logging, script block logging and transcription events are centrally… Loosely related Only shares CSF DE.AE-03: related, not a mapping ISM-1660 Allowed and blocked application control events are centrally logged Loosely related Only shares CSF DE.AE-03: related, not a mapping …and 2 more in the downloads
DORA	Art.28(8)Art.30(2)Art.28(3)Art.28(4)	General principles; Key contractual provisions…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, PR.IR-01: related, not a mapping +18 more loosely related (not mappings) Art.28(5) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.30(3) Key contractual provisions Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.9(4)(b) Protection and prevention Loosely related Only shares CSF ID.AM-03, PR.IR-01: related, not a mapping Art.10(1) Detection Loosely related Only shares CSF DE.AE-04, DE.CM-01: related, not a mapping …and 14 more in the downloads
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping +1 more loosely related (not mappings) Para 23 Detect and respond to incidents in a timely manner Loosely related Only shares CSF DE.CM-01: related, not a mapping
Cyber Essentials	CE 1 CE 4	Firewalls; User Access Control	Loosely related	No mapping. Only shares CSF ID.AM-03, PR.IR-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.