PCI DSS · Requirement 12: Support information security with organizational policies and programs
12.5.1
Inventory of in-scope system components
frameworkPCI DSS v4.0.1
sectionRequirement 12: Support information security with organizational policies and programs
csf 2.0DE.AE-03 DE.AE-04 DE.AE-07 GV.OC-04 GV.OC-05 ID.AM-01 ID.AM-02 PR.AA-01 RC.RP-04 RS.AN-08
topicsAsset Management
frameworks7 6 0
Official text · not licensableSummary (ControlMapping's wording): Inventory of in-scope system components. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-01ID.AM-02ID.AM-04ID.AM-08 | Inventories of hardware managed by the organization are maintained; Inventories of software, services, and systems managed by the organization are maintained… | Crosswalk | Same topic: Asset Management8 loosely related (not mappings)DE.AE-03 Information is correlated from multiple sources Only shares CSF DE.AE-03: related, not a mapping DE.AE-04 The estimated impact and scope of adverse events are understood Only shares CSF DE.AE-04: related, not a mapping DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis Only shares CSF DE.AE-07: related, not a mapping GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated Only shares CSF GV.OC-04: related, not a mapping GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated Only shares CSF GV.OC-05: related, not a mapping PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization Only shares CSF PR.AA-01: related, not a mapping RC.RP-04 Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms Only shares CSF RC.RP-04: related, not a mapping RS.AN-08 An incident's magnitude is estimated and validated Only shares CSF RS.AN-08: related, not a mapping |
| ISO 27001 | A.5.9A.5.11A.7.14 | Inventory of information and other associated assets; Return of assets… | Crosswalk | Same topic: Asset Management |
| CIS v8.1 | CIS 1.1CIS 2.1CIS 1.2CIS 1.3CIS 1.4CIS 1.5CIS 2.3CIS 2.4CIS 16.4 | Establish and Maintain Detailed Enterprise Asset Inventory; Establish and Maintain a Software Inventory… | Crosswalk | Same topic: Asset Management |
| SOC 2 | CC6.1 | Logical access security over information assets | Editorial | Same topic: Asset Management (editorial pick)8 loosely related (not mappings)A1.1 Capacity management to meet availability commitments Only shares CSF GV.OC-04, RC.RP-04: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Only shares CSF GV.OC-04, RC.RP-04: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Only shares CSF GV.OC-04, GV.OC-05: related, not a mapping CC7.2 Monitoring system components for anomalies Only shares CSF DE.AE-03, DE.AE-04: related, not a mapping CC9.1 Mitigating risks from business disruptions Only shares CSF GV.OC-04, RC.RP-04: related, not a mapping CC6.3 Role-based access, least privilege and segregation of duties Only shares CSF PR.AA-01: related, not a mapping CC7.3 Evaluating security events to determine if they are incidents Only shares CSF DE.AE-03: related, not a mapping |
| CMMC | CM.L2-3.4.1 | System Baselining | Crosswalk | Same topic: Asset Management24 loosely related (not mappings)…and 16 more in the downloads |
| 800-53 | CM-8PM-5 | System Component Inventory; System Inventory | Crosswalk | Same topic: Asset Management |
| HIPAA | §164.310(d)§164.310(d)(2)(iii) | Device and Media Controls; Accountability | Crosswalk | Same topic: Asset Management34 loosely related (not mappings)§164.308(a)(6) Security Incident Procedures Only shares CSF DE.AE-03, RC.RP-04, RS.AN-08: related, not a mapping §164.308(a)(6)(ii) Response and Reporting Only shares CSF DE.AE-03, RC.RP-04, RS.AN-08: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Only shares CSF GV.OC-05, ID.AM-02: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Only shares CSF GV.OC-05, ID.AM-02: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Only shares CSF GV.OC-04, PR.AA-01: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF GV.OC-05, ID.AM-02: related, not a mapping …and 26 more in the downloads |
| GDPR | Art.30(1) | Records of processing activities | Editorial | Same topic: Asset Management (editorial pick)2 loosely related (not mappings)Art.32(1)(b) Security of processing Only shares CSF GV.OC-04, PR.AA-01, RC.RP-04: related, not a mapping |
| NIS2 | 12.4 | Asset inventory | Crosswalk | Same topic: Asset Management8 loosely related (not mappings) |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | Editorial | Same topic: Asset Management (editorial pick)9 loosely related (not mappings)ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Only shares CSF DE.AE-03, DE.AE-04: related, not a mapping ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security… Only shares CSF DE.AE-03: related, not a mapping ISM-1509 Privileged access events are centrally logged Only shares CSF DE.AE-03: related, not a mapping ISM-1623 PowerShell module logging, script block logging and transcription events are centrally… Only shares CSF DE.AE-03: related, not a mapping ISM-1660 Allowed and blocked application control events are centrally logged Only shares CSF DE.AE-03: related, not a mapping ISM-1683 Successful and unsuccessful multi-factor authentication events are centrally logged Only shares CSF DE.AE-03: related, not a mapping ISM-1815 Event logs are protected from unauthorised modification and deletion Only shares CSF DE.AE-03: related, not a mapping ISM-1906 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… Only shares CSF DE.AE-03: related, not a mapping …and 1 more in the downloads |
| DORA | Art.8(1)Art.8(4)Art.8(6) | Identification; Identification… | Editorial | Same topic: Asset Management (editorial pick)11 loosely related (not mappings)…and 3 more in the downloads |
| CPS 234 | Para 20 | Classify information assets by criticality and sensitivity | Editorial | Same topic: Asset Management (editorial pick)1 loosely related (not mappings)Para 17 Keep capability current as threats and vulnerabilities change Only shares CSF DE.AE-07: related, not a mapping |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Asset Management (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.