PCI DSS · Requirement 12: Support information security with organizational policies and programs
12.10.6
Plan updated from lessons learned and industry changes
frameworkPCI DSS v4.0.1
sectionRequirement 12: Support information security with organizational policies and programs
csf 2.0GV.OV-01 GV.OV-02 GV.RM-04 GV.RR-01 GV.SC-08 ID.IM-02 ID.IM-04 PR.IR-03 RC.RP-02 RC.RP-06 RS.CO-03 RS.MA-03 RS.MA-05
topicsLessons Learned
frameworks5 4 1
Official text · not licensableSummary (ControlMapping's wording): Plan updated from lessons learned and industry changes. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.IM-03RC.RP-06 | Improvements are identified from execution of operational processes, procedures, and activities; The end of incident recovery is declared based on criteria, and incident-related documentation is completed | Crosswalk | Same topic: Lessons Learned10 loosely related (not mappings)GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Only shares CSF GV.OV-01: related, not a mapping GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks Only shares CSF GV.OV-02: related, not a mapping GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated Only shares CSF GV.RM-04: related, not a mapping GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving Only shares CSF GV.RR-01: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Only shares CSF GV.SC-08: related, not a mapping PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations Only shares CSF PR.IR-03: related, not a mapping RC.RP-02 Recovery actions are selected, scoped, prioritized, and performed Only shares CSF RC.RP-02: related, not a mapping RS.CO-03 Information is shared with designated internal and external stakeholders Only shares CSF RS.CO-03: related, not a mapping …and 2 more in the downloads |
| ISO 27001 | A.5.27Clause 10.1 | Learning from information security incidents; Continual improvement | Crosswalk | Same topic: Lessons Learned22 loosely related (not mappings)A.5.26 Response to information security incidents Only shares CSF GV.SC-08, ID.IM-04, RC.RP-02, RS.CO-03: related, not a mapping A.5.1 Policies for information security Only shares CSF GV.OV-01, GV.OV-02, GV.RM-04: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF GV.OV-01, GV.OV-02, ID.IM-02: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Only shares CSF GV.OV-01, GV.OV-02, ID.IM-04: related, not a mapping A.5.6 Contact with special interest groups Only shares CSF GV.OV-01, RS.CO-03: related, not a mapping A.5.24 Information security incident management planning and preparation Only shares CSF GV.OV-01, ID.IM-04: related, not a mapping A.5.25 Assessment and decision on information security events Only shares CSF RS.MA-03, RS.MA-05: related, not a mapping A.5.35 Independent review of information security Only shares CSF GV.OV-02, ID.IM-02: related, not a mapping …and 14 more in the downloads |
| CIS v8.1 | CIS 17.8 | Conduct Post-Incident Reviews | Editorial | Same topic: Lessons Learned (editorial pick)9 loosely related (not mappings)CIS 17.7 Conduct Routine Incident Response Exercises Only shares CSF ID.IM-02, ID.IM-04, RS.MA-03: related, not a mapping CIS 17.9 Establish and Maintain Security Incident Thresholds Only shares CSF ID.IM-04, RS.MA-03, RS.MA-05: related, not a mapping CIS 14.1 Establish and Maintain a Security Awareness Program Only shares CSF GV.RR-01: related, not a mapping CIS 15.4 Ensure Service Provider Contracts Include Security Requirements Only shares CSF GV.SC-08: related, not a mapping CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Only shares CSF RS.CO-03: related, not a mapping CIS 11.1 Establish and Maintain a Data Recovery Process Only shares CSF ID.IM-04, PR.IR-03, RC.RP-02: related, not a mapping CIS 17.1 Designate Personnel to Manage Incident Handling Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping CIS 17.5 Assign Key Roles and Responsibilities Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping …and 1 more in the downloads |
| SOC 2 | CC7.5 | Recovering from identified security incidents | Editorial | Same topic: Lessons Learned (editorial pick)10 loosely related (not mappings)A1.3 Testing recovery plan procedures Only shares CSF ID.IM-04, PR.IR-03, RC.RP-02: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Only shares CSF PR.IR-03, RC.RP-02: related, not a mapping CC7.3 Evaluating security events to determine if they are incidents Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping CC7.4 Responding to identified security incidents Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping A1.1 Capacity management to meet availability commitments Only shares CSF PR.IR-03: related, not a mapping CC1.2 Board independence and oversight of internal control Only shares CSF GV.RR-01: related, not a mapping CC1.3 Structures, reporting lines, authorities and responsibilities Only shares CSF GV.RR-01: related, not a mapping CC1.5 Accountability for internal control responsibilities Only shares CSF GV.RR-01: related, not a mapping …and 2 more in the downloads |
| CMMC | IR.L2-3.6.1 | Incident Handling | Crosswalk | Same topic: Lessons Learned4 loosely related (not mappings)IR.L2-3.6.3 Incident Response Testing Only shares CSF ID.IM-02, ID.IM-04, RS.MA-03: related, not a mapping |
| 800-53 | IR-4 | Incident Handling | Crosswalk | Same topic: Lessons Learned33 loosely related (not mappings)IR-8 Incident Response Plan Only shares CSF ID.IM-02, ID.IM-04, RC.RP-02, RC.RP-06…: related, not a mapping PM-30 Supply Chain Risk Management Strategy Only shares CSF GV.OV-01, GV.OV-02, GV.RM-04: related, not a mapping PM-31 Continuous Monitoring Strategy Only shares CSF GV.OV-01, GV.OV-02, ID.IM-02: related, not a mapping SR-2 Supply Chain Risk Management Plan Only shares CSF GV.RM-04, GV.SC-08, ID.IM-04: related, not a mapping …and 25 more in the downloads |
| HIPAA | §164.308(a)(6)§164.308(a)(6)(ii)§164.308(a)(7)§164.308(a)(7)(ii)(D) | Security Incident Procedures; Response and Reporting… | No mapping. Only shares CSF GV.OV-01, GV.SC-08, ID.IM-02, RC.RP-02…: related, not a mapping+33 more loosely related (not mappings)§164.316(b)(2)(iii) Updates Only shares CSF GV.OV-01, GV.SC-08, ID.IM-02, ID.IM-04: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF ID.IM-02, RS.CO-03, RS.MA-03: related, not a mapping §164.308(a)(7)(ii)(B) Disaster Recovery Plan Only shares CSF ID.IM-02, ID.IM-04, RC.RP-02: related, not a mapping §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Only shares CSF ID.IM-02, ID.IM-04, RC.RP-02: related, not a mapping …and 29 more in the downloads | |
| GDPR | Art.32(1)(c)Art.33(1)Art.33(5)Art.32(1)(b) | Security of processing; Notification of a personal data breach to the supervisory authority… | No mapping. Only shares CSF ID.IM-04, PR.IR-03, RC.RP-02, RS.MA-03: related, not a mapping | |
| NIS2 | 3.6 | Post-incident reviews | Crosswalk | Same topic: Lessons Learned |
| Essential Eight | ISM-1515ISM-1819 | Restoration of data, applications and settings from backups to a common point in time…; Following the identification of a cyber security incident, the cyber security incident… | No mapping. Only shares CSF PR.IR-03, RC.RP-02, ID.IM-04, RS.MA-03: related, not a mapping | |
| DORA | Art.13(2)Art.13(3) | Learning and evolving; Learning and evolving | Editorial | Same topic: Lessons Learned (editorial pick)16 loosely related (not mappings)Art.12(4) Backup policies and procedures, restoration and recovery procedures and methods Only shares CSF PR.IR-03, RC.RP-02: related, not a mapping Art.12(6) Backup policies and procedures, restoration and recovery procedures and methods Only shares CSF ID.IM-04, RC.RP-02: related, not a mapping Art.17(1) ICT-related incident management process Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping Art.17(3) ICT-related incident management process Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping Art.18(1) Classification of ICT-related incidents and cyber threats Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping …and 8 more in the downloads |
| CPS 234 | Para 25 | Response plans cover all stages and escalation | Editorial | Same topic: Lessons Learned (editorial pick)5 loosely related (not mappings)Para 23 Detect and respond to incidents in a timely manner Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping Para 24 Maintain information security response plans Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping Para 26 Review and test response plans annually Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping Para 13 Board ultimately responsible for information security Only shares CSF GV.RR-01: related, not a mapping Para 14 Define information security roles and responsibilities Only shares CSF GV.RR-01: related, not a mapping |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.