PCI DSS · Requirement 12: Support information security with organizational policies and programs

Awareness training on hire and at least annually

frameworkPCI DSS v4.0.1 sectionRequirement 12: Support information security with organizational policies and programs csf 2.0GV.RR-04 PR.AT-01 topicsAwareness & Training frameworks7 3 3

Official text · not licensableSummary (ControlMapping's wording): Awareness training on hire and at least annually. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 12.6.3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AT-01 PR.AT-02	Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind; Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind	Crosswalk	Same topic: Awareness & Training 1 loosely related (not mappings) GV.RR-04 Cybersecurity is included in human resources practices Loosely related Only shares CSF GV.RR-04: related, not a mapping
ISO 27001	A.6.3 Clause 7.3	Information security awareness, education and training; Awareness	Crosswalk	Same topic: Awareness & Training 7 loosely related (not mappings) A.6.1 Screening Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.4 Disciplinary process Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.6 Confidentiality or non-disclosure agreements Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.7 Remote working Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.8 Information security event reporting Loosely related Only shares CSF GV.RR-04: related, not a mapping
CIS v8.1	CIS 14.1 CIS 14.9 CIS 14.2 CIS 14.3 CIS 14.4 CIS 14.5 CIS 14.6 CIS 14.7 CIS 14.8	Establish and Maintain a Security Awareness Program; Conduct Role-Specific Security Awareness and Skills Training…	Crosswalk	Same topic: Awareness & Training 2 loosely related (not mappings) CIS 6.1 Establish an Access Granting Process Loosely related Only shares CSF GV.RR-04: related, not a mapping CIS 6.2 Establish an Access Revoking Process Loosely related Only shares CSF GV.RR-04: related, not a mapping
SOC 2	CC1.4 CC2.2	Commitment to attracting, developing and retaining competent people; Internal communication of objectives and responsibilities	Editorial	Same topic: Awareness & Training (editorial pick)
CMMC	AT.L2-3.2.1 AT.L2-3.2.2 AT.L2-3.2.3	Role-Based Risk Awareness; Role-Based Training…	Crosswalk	Same topic: Awareness & Training 2 loosely related (not mappings) AU.L2-3.3.2 User Accountability Loosely related Only shares CSF GV.RR-04: related, not a mapping PS.L2-3.9.1 Screen Individuals Loosely related Only shares CSF GV.RR-04: related, not a mapping
800-53	AT-2 AT-3	Literacy Training and Awareness; Role-based Training	Crosswalk	Same topic: Awareness & Training 5 loosely related (not mappings) PM-13 Security and Privacy Workforce Loosely related Only shares CSF GV.RR-04: related, not a mapping PS-7 External Personnel Security Loosely related Only shares CSF GV.RR-04: related, not a mapping PS-9 Position Descriptions Loosely related Only shares CSF GV.RR-04: related, not a mapping AC-2(12) Account Monitoring for Atypical Usage Loosely related Only shares CSF GV.RR-04: related, not a mapping PM-12 Insider Threat Program Loosely related Only shares CSF GV.RR-04: related, not a mapping
HIPAA	§164.308(a)(5)§164.308(a)(5)(ii)(A)	Security Awareness and Training; Security Reminders	Crosswalk	Same topic: Awareness & Training 15 loosely related (not mappings) §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF GV.RR-04: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF GV.RR-04: related, not a mapping §164.308(a)(3)(ii)(C) Termination Procedures Loosely related Only shares CSF GV.RR-04: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF GV.RR-04: related, not a mapping §164.308(a)(5)(ii)(B) Protection from Malicious Software Loosely related Only shares CSF PR.AT-01: related, not a mapping §164.308(a)(5)(ii)(C) Log-in Monitoring Loosely related Only shares CSF PR.AT-01: related, not a mapping §164.308(a)(5)(ii)(D) Password Management Loosely related Only shares CSF PR.AT-01: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.RR-04: related, not a mapping …and 7 more in the downloads
GDPR	Art.39(1)(b)	Tasks of the data protection officer	Editorial	Same topic: Awareness & Training (editorial pick) 2 loosely related (not mappings) Art.29 Processing under the authority of the controller or processor Loosely related Only shares CSF GV.RR-04: related, not a mapping Art.32(4) Security of processing Loosely related Only shares CSF GV.RR-04: related, not a mapping
NIS2	8.1 8.2	Awareness raising and basic cyber hygiene practices; Security training	Crosswalk	Same topic: Awareness & Training 3 loosely related (not mappings) 10.1 Human resources security Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.2 Verification of Background Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.3 Termination or change of employment procedures Loosely related Only shares CSF GV.RR-04: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(4)Art.13(6)	Governance and organisation; Learning and evolving	Editorial	Same topic: Awareness & Training (editorial pick) 1 loosely related (not mappings) Art.10(3) Detection Loosely related Only shares CSF GV.RR-04: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.