PCI DSS · Requirement 12: Support information security with organizational policies and programs

PCI DSS scope confirmed annually and on change

frameworkPCI DSS v4.0.1 sectionRequirement 12: Support information security with organizational policies and programs csf 2.0GV.OC-04 GV.OC-05 GV.OV-02 GV.SC-04 GV.SC-06 GV.SC-07 GV.SC-10 ID.AM-03 ID.AM-07 topicsBusiness Environment frameworks3 2 1

Official text · not licensableSummary (ControlMapping's wording): PCI DSS scope confirmed annually and on change. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 12.5.2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-01 GV.OC-04 GV.OC-05	The organizational mission is understood and informs cybersecurity risk management; Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated…	Crosswalk	Same topic: Business Environment 7 loosely related (not mappings) GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks Loosely related Only shares CSF GV.OV-02: related, not a mapping GV.SC-04 Suppliers are known and prioritized by criticality Loosely related Only shares CSF GV.SC-04: related, not a mapping GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships Loosely related Only shares CSF GV.SC-06: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Loosely related Only shares CSF GV.SC-07: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained Loosely related Only shares CSF ID.AM-03: related, not a mapping ID.AM-07 Inventories of data and corresponding metadata for designated data types are maintained Loosely related Only shares CSF ID.AM-07: related, not a mapping
ISO 27001	Clause 4.1 Clause 4.2	Understanding the organization and its context; Understanding the needs and expectations of interested parties	Crosswalk	Same topic: Business Environment 20 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-02, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-04, GV.SC-06, GV.SC-07, GV.SC-10: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-04, GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-02: related, not a mapping …and 12 more in the downloads
CIS v8.1	CIS 15.7 CIS 3.8 CIS 3.2 CIS 15.1	Securely Decommission Service Providers; Document Data Flows…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, GV.SC-10…: related, not a mapping +11 more loosely related (not mappings) CIS 15.3 Classify Service Providers Loosely related Only shares CSF GV.SC-04: related, not a mapping CIS 15.5 Assess Service Providers Loosely related Only shares CSF GV.SC-06: related, not a mapping CIS 15.6 Monitor Service Providers Loosely related Only shares CSF GV.SC-07: related, not a mapping CIS 15.4 Ensure Service Provider Contracts Include Security Requirements Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping …and 7 more in the downloads
SOC 2	CC3.1	Objectives specified clearly enough to identify risks	Editorial	Same topic: Business Environment (editorial pick) 6 loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF GV.OC-04: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF GV.OC-04: related, not a mapping C1.1 Identifying and protecting confidential information Loosely related Only shares CSF ID.AM-07: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF ID.AM-03: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF GV.OC-04: related, not a mapping
CMMC	RA.L2-3.11.1 CA.L2-3.12.4 RA.L2-3.11.2 RA.L2-3.11.3	Risk Assessments; System Security Plan…	Loosely related	No mapping. Only shares CSF GV.OV-02, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping +1 more loosely related (not mappings) MP.L2-3.8.4 Media Markings Loosely related Only shares CSF ID.AM-07: related, not a mapping
800-53	PM-11 RA-9	Mission and Business Process Definition; Criticality Analysis	Crosswalk	Same topic: Business Environment 25 loosely related (not mappings) SA-9 External System Services Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.OV-02, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.OC-04, GV.OC-05, GV.OV-02: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OC-05, GV.OV-02, GV.SC-10: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF GV.SC-06, GV.SC-07, GV.SC-10: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.OC-05, GV.SC-06, GV.SC-10: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.OV-02, GV.SC-10: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-07, GV.SC-10: related, not a mapping …and 17 more in the downloads
HIPAA	§164.308(b)(1)§164.308(b)(4)§164.314(a)(2)(ii)§164.314(a)	Business Associate Contracts and Other Arrangements; Written Contract or Other Arrangement…	Loosely related	No mapping. Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping +24 more loosely related (not mappings) §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF GV.SC-10, ID.AM-03: related, not a mapping …and 20 more in the downloads
GDPR	Art.28(1)Art.28(3)Art.32(1)(b)	Processor; Processor…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, GV.OC-04: related, not a mapping
NIS2	5.1 5.2 12.4 2.2	Supply chain security policy; Directory of suppliers and service providers…	Loosely related	No mapping. Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping +5 more loosely related (not mappings) 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OV-02: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.OC-04: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF ID.AM-03: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.SC-06: related, not a mapping …and 1 more in the downloads
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.8(1)Art.11(5)	Identification; Response and recovery	Editorial	Same topic: Business Environment (editorial pick) 10 loosely related (not mappings) Art.28(3) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.28(4) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.28(5) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.28(8) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.30(3) Key contractual provisions Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.9(4)(b) Protection and prevention Loosely related Only shares CSF ID.AM-03: related, not a mapping Art.11(1) Response and recovery Loosely related Only shares CSF GV.OC-04: related, not a mapping …and 2 more in the downloads
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping +1 more loosely related (not mappings) Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-07: related, not a mapping
Cyber Essentials	CE 1	Firewalls	Loosely related	No mapping. Only shares CSF ID.AM-03: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.