PCI DSS · Requirement 11: Test security of systems and networks regularly
11.3.2
External ASV scans every three months
frameworkPCI DSS v4.0.1
sectionRequirement 11: Test security of systems and networks regularly
csf 2.0DE.CM-09 GV.OV-03 ID.IM-03 ID.RA-01 ID.RA-06
topicsVulnerability Mgmt
frameworks7 6 0
Official text · not licensableSummary (ControlMapping's wording): External ASV scans every three months. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01ID.RA-08 | Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Crosswalk | Same topic: Vulnerability Mgmt3 loosely related (not mappings)DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events Only shares CSF DE.CM-09: related, not a mapping GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed Only shares CSF GV.OV-03: related, not a mapping ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated Only shares CSF ID.RA-06: related, not a mapping |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | Crosswalk | Same topic: Vulnerability Mgmt14 loosely related (not mappings)Clause 9.1 Monitoring, measurement, analysis and evaluation Only shares CSF GV.OV-03, ID.IM-03: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF GV.OV-03: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OV-03: related, not a mapping …and 6 more in the downloads |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process… | Crosswalk | Same topic: Vulnerability Mgmt15 loosely related (not mappings)CIS 9.1 Ensure Use of Only Fully Supported Browsers and Email Clients Only shares CSF DE.CM-09: related, not a mapping CIS 9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions Only shares CSF DE.CM-09: related, not a mapping CIS 9.7 Deploy and Maintain Email Server Anti-Malware Protections Only shares CSF DE.CM-09: related, not a mapping …and 7 more in the downloads |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Vulnerability Mgmt (editorial pick)7 loosely related (not mappings)CC3.4 Identifying and assessing significant changes Only shares CSF ID.RA-06: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Only shares CSF GV.OV-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Only shares CSF GV.OV-03: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Only shares CSF DE.CM-09: related, not a mapping |
| CMMC | RA.L2-3.11.2RA.L2-3.11.3 | Vulnerability Scan; Vulnerability Remediation | Crosswalk | Same topic: Vulnerability Mgmt15 loosely related (not mappings)CA.L2-3.12.1 Security Control Assessment Only shares CSF GV.OV-03, ID.IM-03, ID.RA-01: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Only shares CSF DE.CM-09, ID.IM-03, ID.RA-01: related, not a mapping CM.L2-3.4.9 User-Installed Software Only shares CSF DE.CM-09, ID.IM-03, ID.RA-01: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Only shares CSF DE.CM-09, ID.IM-03, ID.RA-01: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Only shares CSF DE.CM-09, ID.IM-03, ID.RA-01: related, not a mapping …and 7 more in the downloads |
| 800-53 | CA-8RA-5 | Penetration Testing; Vulnerability Monitoring and Scanning | Crosswalk | Same topic: Vulnerability Mgmt26 loosely related (not mappings)PM-4 Plan of Action and Milestones Process Only shares CSF GV.OV-03, ID.IM-03: related, not a mapping …and 18 more in the downloads |
| HIPAA | §164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B) | Evaluation; Risk Analysis… | Crosswalk | Same topic: Vulnerability Mgmt10 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF DE.CM-09, ID.IM-03, ID.RA-01: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF DE.CM-09, ID.IM-03: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Only shares CSF DE.CM-09, ID.IM-03: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF DE.CM-09: related, not a mapping …and 2 more in the downloads |
| GDPR | Art.32(1)(d) | Security of processing | Editorial | Same topic: Vulnerability Mgmt (editorial pick)3 loosely related (not mappings)Art.5(2) Principles relating to processing of personal data Only shares CSF GV.OV-03: related, not a mapping |
| NIS2 | 6.56.10 | Security testing; Vulnerability handling and disclosure | Crosswalk | Same topic: Vulnerability Mgmt |
| Essential Eight | ISM-1698ISM-1699ISM-1701ISM-1702ISM-1807ISM-1808 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…; A vulnerability scanner is used at least weekly to identify missing patches or updates…… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)33 loosely related (not mappings)ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security… Only shares CSF DE.CM-09: related, not a mapping ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF ID.RA-01: related, not a mapping ISM-0843 Application control is implemented on workstations Only shares CSF DE.CM-09: related, not a mapping ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Only shares CSF DE.CM-09: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF ID.RA-01: related, not a mapping ISM-1488 Microsoft Office macros in files originating from the internet are blocked Only shares CSF DE.CM-09: related, not a mapping ISM-1490 Application control is implemented on internet-facing servers Only shares CSF DE.CM-09: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Only shares CSF ID.RA-01: related, not a mapping …and 25 more in the downloads |
| DORA | Art.8(2)Art.25(1)Art.26(1)Art.27(1) | Identification; Testing of ICT tools and systems… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)8 loosely related (not mappings) |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)4 loosely related (not mappings)Para 21 Timely controls commensurate with risk and asset life-cycle Only shares CSF ID.RA-06: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Only shares CSF GV.OV-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Only shares CSF GV.OV-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Only shares CSF GV.OV-03: related, not a mapping |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Vulnerability Mgmt (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.