PCI DSS · Requirement 11: Test security of systems and networks regularly

Payment page changes and tampering detected

frameworkPCI DSS v4.0.1 sectionRequirement 11: Test security of systems and networks regularly csf 2.0GV.RM-03 GV.RM-06 GV.SC-01 GV.SC-03 GV.SC-07 GV.SC-09 ID.AM-05 ID.AM-08 topics— frameworks0 0 0

Official text · not licensableSummary (ControlMapping's wording): Payment page changes and tampering detected. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 11.6.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RM-03 GV.RM-06 GV.SC-01 GV.SC-03	Cybersecurity risk management activities and outcomes are included in enterprise risk management processes; A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, GV.SC-01, GV.SC-03: related, not a mapping +4 more loosely related (not mappings) GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Loosely related Only shares CSF GV.SC-07: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission Loosely related Only shares CSF ID.AM-05: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Loosely related Only shares CSF ID.AM-08: related, not a mapping
ISO 27001	A.5.19 A.5.1 A.5.20 A.5.22	Information security in supplier relationships; Policies for information security…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping +14 more loosely related (not mappings) A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.RM-06, GV.SC-07, GV.SC-09: related, not a mapping A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping A.5.12 Classification of information Loosely related Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping …and 10 more in the downloads
CIS v8.1	CIS 15.6 CIS 1.1 CIS 3.5 CIS 3.7	Monitor Service Providers; Establish and Maintain Detailed Enterprise Asset Inventory…	Loosely related	No mapping. Only shares CSF GV.SC-07, GV.SC-09, ID.AM-08, ID.AM-05: related, not a mapping +11 more loosely related (not mappings) CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF GV.SC-01: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads
SOC 2	CC9.2 CC3.1 CC5.1 CC9.1	Managing vendor and business partner risk; Objectives specified clearly enough to identify risks…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping +2 more loosely related (not mappings) C1.1 Identifying and protecting confidential information Loosely related Only shares CSF ID.AM-05: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-08: related, not a mapping
CMMC	RA.L2-3.11.1 CA.L2-3.12.4 MA.L2-3.7.1 MA.L2-3.7.3	Risk Assessments; System Security Plan…	Loosely related	No mapping. Only shares CSF GV.RM-06, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping +2 more loosely related (not mappings) SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF ID.AM-08: related, not a mapping MP.L2-3.8.4 Media Markings Loosely related Only shares CSF ID.AM-05: related, not a mapping
800-53	PM-30 PM-9 RA-3 SR-2	Supply Chain Risk Management Strategy; Risk Management Strategy…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, GV.SC-01, GV.SC-03…: related, not a mapping +27 more loosely related (not mappings) SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.RM-03, GV.SC-03, GV.SC-09: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping PM-18 Privacy Program Plan Loosely related Only shares CSF GV.RM-06, GV.SC-03: related, not a mapping …and 23 more in the downloads
HIPAA	§164.308(a)(1)(ii)(B)§164.316(a)§164.308(a)(1)(ii)(A)§164.308(b)(4)	Risk Management; Policies and Procedures…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, GV.SC-03, GV.SC-09…: related, not a mapping +34 more loosely related (not mappings) §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.SC-07, GV.SC-09: related, not a mapping …and 30 more in the downloads
GDPR	Art.28(1)Art.24(1)Art.32(2)Art.28(3)	Processor; Responsibility of the controller…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping +1 more loosely related (not mappings) Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-08: related, not a mapping
NIS2	5.1 2.1 1.1 6.2	Supply chain security policy; Risk management framework…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-07, GV.SC-09, GV.RM-03…: related, not a mapping +3 more loosely related (not mappings) 7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures Loosely related Only shares CSF GV.RM-06: related, not a mapping 12.1 Asset classification Loosely related Only shares CSF ID.AM-05: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.28(2)Art.29(1)Art.29(2)Art.5(2)(a)	General principles; Preliminary assessment of ICT concentration risk at entity level…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09, GV.RM-03…: related, not a mapping +13 more loosely related (not mappings) Art.6(1) ICT risk management framework Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.6(8) ICT risk management framework Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping Art.16(1) Simplified ICT risk management framework Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping …and 9 more in the downloads
CPS 234	Para 16 Para 22 Para 13 Para 15	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping +5 more loosely related (not mappings) Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping Para 27 Systematic testing programme for control effectiveness Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 31 Review the testing programme at least annually Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 28 Check third parties' control testing is adequate Loosely related Only shares CSF GV.SC-07: related, not a mapping …and 1 more in the downloads
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.