PCI DSS · Requirement 11: Test security of systems and networks regularly
11.4.4
Penetration test findings corrected and retested
frameworkPCI DSS v4.0.1
sectionRequirement 11: Test security of systems and networks regularly
csf 2.0GV.OV-02 GV.OV-03 ID.IM-02 ID.RA-01 PR.PS-06 RC.RP-05
topics—
frameworks0 0 0
Official text · not licensableSummary (ControlMapping's wording): Penetration test findings corrected and retested. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.OV-02GV.OV-03ID.RA-01PR.PS-06 | The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks; Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed… | No mapping. Only shares CSF GV.OV-02, GV.OV-03, ID.RA-01, PR.PS-06: related, not a mapping+1 more loosely related (not mappings)RC.RP-05 The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed Only shares CSF RC.RP-05: related, not a mapping | |
| ISO 27001 | A.5.19A.5.1A.5.35A.5.36 | Information security in supplier relationships; Policies for information security… | No mapping. Only shares CSF GV.OV-02, GV.OV-03, ID.IM-02: related, not a mapping+13 more loosely related (not mappings)Clause 9.1 Monitoring, measurement, analysis and evaluation Only shares CSF GV.OV-02, GV.OV-03: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OV-03: related, not a mapping A.5.27 Learning from information security incidents Only shares CSF GV.OV-02: related, not a mapping …and 9 more in the downloads | |
| CIS v8.1 | CIS 7.1CIS 16.1CIS 7.5CIS 7.6 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Secure Application Development Process… | No mapping. Only shares CSF ID.RA-01, PR.PS-06: related, not a mapping | |
| SOC 2 | A1.2A1.3CC2.3CC4.1 | Environmental protections, backups and recovery infrastructure; Testing recovery plan procedures… | No mapping. Only shares CSF RC.RP-05, GV.OV-03: related, not a mapping+5 more loosely related (not mappings)CC4.2 Communicating and remediating control deficiencies Only shares CSF GV.OV-03: related, not a mapping CC6.6 Protection against threats from outside system boundaries Only shares CSF PR.PS-06: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Only shares CSF ID.RA-01: related, not a mapping CC7.5 Recovering from identified security incidents Only shares CSF RC.RP-05: related, not a mapping …and 1 more in the downloads | |
| CMMC | RA.L2-3.11.1CA.L2-3.12.1CA.L2-3.12.3CM.L2-3.4.9 | Risk Assessments; Security Control Assessment… | No mapping. Only shares CSF GV.OV-02, GV.OV-03, ID.IM-02, ID.RA-01: related, not a mapping+6 more loosely related (not mappings)SI.L2-3.14.6 Monitor Communications for Attacks Only shares CSF ID.IM-02, ID.RA-01: related, not a mapping …and 2 more in the downloads | |
| 800-53 | CA-2RA-7SA-11CA-7 | Control Assessments; Risk Response… | No mapping. Only shares CSF GV.OV-03, ID.IM-02, ID.RA-01, GV.OV-02…: related, not a mapping+21 more loosely related (not mappings)PM-4 Plan of Action and Milestones Process Only shares CSF GV.OV-03, ID.IM-02: related, not a mapping …and 17 more in the downloads | |
| HIPAA | §164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D) | Evaluation; Risk Analysis… | No mapping. Only shares CSF GV.OV-03, ID.IM-02, ID.RA-01: related, not a mapping+5 more loosely related (not mappings)§164.308(a)(7)(ii)(B) Disaster Recovery Plan Only shares CSF ID.IM-02, RC.RP-05: related, not a mapping §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Only shares CSF ID.IM-02, RC.RP-05: related, not a mapping §164.308(a)(7)(ii)(D) Testing and Revision Procedure Only shares CSF ID.IM-02, RC.RP-05: related, not a mapping …and 1 more in the downloads | |
| GDPR | Art.5(2)Art.25(1)Art.32(1)(c)Art.32(1)(d) | Principles relating to processing of personal data; Data protection by design and by default… | No mapping. Only shares CSF GV.OV-03, PR.PS-06, RC.RP-05, ID.RA-01: related, not a mapping+1 more loosely related (not mappings)Art.34(1) Communication of a personal data breach to the data subject Only shares CSF RC.RP-05: related, not a mapping | |
| NIS2 | 2.32.12.26.2 | Independent review of information and network security; Risk management framework… | No mapping. Only shares CSF GV.OV-02, GV.OV-03, ID.RA-01, PR.PS-06: related, not a mapping | |
| Essential Eight | ISM-0304ISM-1407ISM-1501ISM-1515 | Applications other than office productivity suites, web browsers and their extensions…; The latest release, or the previous release, of operating systems are used… | No mapping. Only shares CSF ID.RA-01, RC.RP-05: related, not a mapping+26 more loosely related (not mappings)ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF ID.RA-01: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Only shares CSF ID.RA-01: related, not a mapping …and 22 more in the downloads | |
| DORA | Art.5(2)(f)Art.6(6)Art.6(7)Art.8(2) | Governance and organisation; ICT risk management framework… | No mapping. Only shares CSF GV.OV-03, ID.RA-01: related, not a mapping+7 more loosely related (not mappings)Art.12(4) Backup policies and procedures, restoration and recovery procedures and methods Only shares CSF RC.RP-05: related, not a mapping …and 3 more in the downloads | |
| CPS 234 | Para 17Para 27Para 30Para 32 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness… | No mapping. Only shares CSF ID.RA-01, GV.OV-03: related, not a mapping | |
| Cyber Essentials | CE 3 | Security Update Management | No mapping. Only shares CSF ID.RA-01: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.