PCI DSS · Requirement 12: Support information security with organizational policies and programs
12.1.4
Executive responsibility for information security assigned
frameworkPCI DSS v4.0.1
sectionRequirement 12: Support information security with organizational policies and programs
csf 2.0GV.OC-02 GV.PO-01 GV.RM-01 GV.RR-01 GV.RR-03 GV.SC-01 GV.SC-02
topicsRoles & Responsibilities
frameworks5 4 2
Official text · not licensableSummary (ControlMapping's wording): Executive responsibility for information security assigned. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RR-01GV.RR-02GV.RR-03 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving; Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced… | Crosswalk | Same topic: Roles & Responsibilities5 loosely related (not mappings)GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered Only shares CSF GV.OC-02: related, not a mapping GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Only shares CSF GV.PO-01: related, not a mapping GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders Only shares CSF GV.RM-01: related, not a mapping GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders Only shares CSF GV.SC-01: related, not a mapping GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally Only shares CSF GV.SC-02: related, not a mapping |
| ISO 27001 | A.5.2A.5.4 | Information security roles and responsibilities; Management responsibilities | Crosswalk | Same topic: Roles & Responsibilities26 loosely related (not mappings)A.5.1 Policies for information security Only shares CSF GV.PO-01, GV.RM-01, GV.SC-01: related, not a mapping Clause 8.1 Operational planning and control Only shares CSF GV.OC-02, GV.SC-01: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF GV.SC-01: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.SC-01: related, not a mapping A.5.21 Managing information security in the ICT supply chain Only shares CSF GV.SC-01: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Only shares CSF GV.SC-01: related, not a mapping …and 18 more in the downloads |
| CIS v8.1 | CIS 14.1CIS 15.2CIS 15.4 | Establish and Maintain a Security Awareness Program; Establish and Maintain a Service Provider Management Policy… | No mapping. Only shares CSF GV.RR-01, GV.SC-01, GV.SC-02: related, not a mapping | |
| SOC 2 | CC1.2CC1.3CC1.5 | Board independence and oversight of internal control; Structures, reporting lines, authorities and responsibilities… | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| CMMC | RA.L2-3.11.1 | Risk Assessments | No mapping. Only shares CSF GV.OC-02: related, not a mapping | |
| 800-53 | PM-2PM-29PS-9 | Information Security Program Leadership Role; Risk Management Program Leadership Roles… | Crosswalk | Same topic: Roles & Responsibilities33 loosely related (not mappings)SR-2 Supply Chain Risk Management Plan Only shares CSF GV.RM-01, GV.SC-01, GV.SC-02: related, not a mapping SR-3 Supply Chain Controls and Processes Only shares CSF GV.OC-02, GV.SC-01, GV.SC-02: related, not a mapping PM-30 Supply Chain Risk Management Strategy Only shares CSF GV.OC-02, GV.SC-01: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Only shares CSF GV.OC-02, GV.SC-02: related, not a mapping …and 25 more in the downloads |
| HIPAA | §164.308(a)(2) | Assigned Security Responsibility | Crosswalk | Same topic: Roles & Responsibilities24 loosely related (not mappings)§164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF GV.PO-01: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF GV.PO-01: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Only shares CSF GV.PO-01: related, not a mapping …and 16 more in the downloads |
| GDPR | Art.37(1)Art.39(1) | Designation of the data protection officer; Tasks of the data protection officer | Editorial | Same topic: Roles & Responsibilities (editorial pick)4 loosely related (not mappings) |
| NIS2 | 1.2 | Roles, responsibilities and authorities | Crosswalk | Same topic: Roles & Responsibilities3 loosely related (not mappings)1.1 Policy on the security of network and information systems Only shares CSF GV.OC-02, GV.PO-01: related, not a mapping |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.5(2)(c)Art.5(3)Art.6(4) | Governance and organisation; Governance and organisation… | Editorial | Same topic: Roles & Responsibilities (editorial pick)11 loosely related (not mappings)Art.24(1) General requirements for the performance of digital operational resilience testing Only shares CSF GV.RM-01: related, not a mapping …and 3 more in the downloads |
| CPS 234 | Para 13Para 14 | Board ultimately responsible for information security; Define information security roles and responsibilities | Editorial | Same topic: Roles & Responsibilities (editorial pick)7 loosely related (not mappings)Para 15 Maintain a capability commensurate with threats Only shares CSF GV.RM-01: related, not a mapping Para 16 Assess third parties' information security capability Only shares CSF GV.SC-01: related, not a mapping Para 18 Maintain an information security policy framework Only shares CSF GV.PO-01: related, not a mapping Para 19 Policies direct everyone with security obligations Only shares CSF GV.PO-01: related, not a mapping Para 22 Evaluate the design of third parties' controls Only shares CSF GV.SC-01: related, not a mapping Para 27 Systematic testing programme for control effectiveness Only shares CSF GV.RM-01: related, not a mapping Para 31 Review the testing programme at least annually Only shares CSF GV.RM-01: related, not a mapping |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.