PCI DSS · Requirement 12: Support information security with organizational policies and programs
12.3.1
Targeted risk analysis for flexible-frequency requirements
frameworkPCI DSS v4.0.1
sectionRequirement 12: Support information security with organizational policies and programs
csf 2.0GV.OV-01 GV.OV-03 GV.RM-06 ID.AM-05 ID.IM-01 ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-07
topicsRisk Management, Risk Assessment
frameworks6 4 2
Official text · not licensableSummary (ControlMapping's wording): Targeted risk analysis for flexible-frequency requirements. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RM-01GV.RM-02GV.RM-03GV.RM-06ID.RA-03ID.RA-04ID.RA-05ID.RA-06 | Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained… | Crosswalk | Same topic: Risk Management, Risk Assessment4 loosely related (not mappings)GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Only shares CSF GV.OV-01: related, not a mapping GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed Only shares CSF GV.OV-03: related, not a mapping ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission Only shares CSF ID.AM-05: related, not a mapping ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked Only shares CSF ID.RA-07: related, not a mapping |
| ISO 27001 | Clause 6.1.1Clause 6.1.2Clause 6.1.3 | General; Information security risk assessment… | Crosswalk | Same topic: Risk Management, Risk Assessment17 loosely related (not mappings)A.5.1 Policies for information security Only shares CSF GV.OV-01, GV.OV-03, GV.RM-06: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF GV.OV-01, GV.OV-03: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Only shares CSF GV.OV-01, GV.OV-03: related, not a mapping A.5.9 Inventory of information and other associated assets Only shares CSF ID.AM-05: related, not a mapping …and 9 more in the downloads |
| CIS v8.1 | CIS 3.7CIS 3.8 | Establish and Maintain a Data Classification Scheme; Document Data Flows | No mapping. Only shares CSF ID.AM-05: related, not a mapping | |
| SOC 2 | CC3.1CC3.2CC3.3CC3.4CC5.1CC9.1 | Objectives specified clearly enough to identify risks; Risk identification and analysis… | Editorial | Same topic: Risk Management, Risk Assessment (editorial pick)3 loosely related (not mappings)C1.1 Identifying and protecting confidential information Only shares CSF ID.AM-05: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Only shares CSF GV.OV-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Only shares CSF GV.OV-03: related, not a mapping |
| CMMC | RA.L2-3.11.1 | Risk Assessments | Crosswalk | Same topic: Risk Management, Risk Assessment5 loosely related (not mappings) |
| 800-53 | PM-9PM-28RA-3RA-7 | Risk Management Strategy; Risk Framing… | Crosswalk | Same topic: Risk Management, Risk Assessment17 loosely related (not mappings)PM-30 Supply Chain Risk Management Strategy Only shares CSF GV.OV-01, GV.RM-06: related, not a mapping …and 9 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B) | Risk Analysis; Risk Management | Crosswalk | Same topic: Risk Assessment, Risk Management25 loosely related (not mappings)§164.316(a) Policies and Procedures Only shares CSF GV.OV-01, GV.RM-06, ID.AM-05, ID.IM-01…: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF ID.AM-05, ID.IM-01, ID.RA-04, ID.RA-05: related, not a mapping §164.308(a)(8) Evaluation Only shares CSF GV.OV-01, GV.OV-03, ID.IM-01, ID.RA-07: related, not a mapping §164.308(a)(1) Security Management Process Only shares CSF GV.OV-01, ID.IM-01: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF ID.IM-01, ID.RA-07: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF GV.OV-01, ID.IM-01: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF GV.OV-01, ID.IM-01: related, not a mapping …and 17 more in the downloads |
| GDPR | Art.24(1)Art.32(2)Art.35(1)Art.35(7) | Responsibility of the controller; Security of processing… | Editorial | Same topic: Risk Management, Risk Assessment (editorial pick)1 loosely related (not mappings)Art.5(2) Principles relating to processing of personal data Only shares CSF GV.OV-03: related, not a mapping |
| NIS2 | 2.17.1 | Risk management framework; Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Crosswalk | Same topic: Risk Management, Risk Assessment |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.5(2)(a)Art.6(1)Art.6(8)Art.8(2)Art.8(3)Art.8(7)Art.16(1)Art.24(1) | Governance and organisation; ICT risk management framework… | Editorial | Same topic: Risk Management, Risk Assessment (editorial pick)6 loosely related (not mappings)Art.45(1) Information-sharing arrangements on cyber threat information and intelligence Only shares CSF ID.RA-03: related, not a mapping |
| CPS 234 | Para 13Para 15Para 17Para 21Para 27Para 31 | Board ultimately responsible for information security; Maintain a capability commensurate with threats… | Editorial | Same topic: Risk Management, Risk Assessment (editorial pick)4 loosely related (not mappings)Para 20 Classify information assets by criticality and sensitivity Only shares CSF ID.AM-05: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Only shares CSF GV.OV-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Only shares CSF GV.OV-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Only shares CSF GV.OV-03: related, not a mapping |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.