PCI DSS · Requirement 12: Support information security with organizational policies and programs

List of third-party service providers kept

frameworkPCI DSS v4.0.1 sectionRequirement 12: Support information security with organizational policies and programs csf 2.0GV.OC-02 GV.OC-03 GV.OC-05 GV.SC-01 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-08 GV.SC-09 ID.AM-02 ID.AM-04 ID.RA-10 topicsSupply Chain Risk, Cloud Security, Vendor Risk Mgmt frameworks7 5 0

Official text · not licensableSummary (ControlMapping's wording): List of third-party service providers kept. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 12.8.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-01 GV.SC-03 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-09 ID.AM-04 ID.RA-09 ID.RA-10 PR.IR-01 PR.PS-01	External service provider activities and services are monitored to find potentially adverse events; A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders…	Crosswalk	Same topic: Vendor Risk Mgmt, Supply Chain Risk, Cloud Security 5 loosely related (not mappings) GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered Loosely related Only shares CSF GV.OC-02: related, not a mapping GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated Loosely related Only shares CSF GV.OC-05: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Loosely related Only shares CSF GV.SC-08: related, not a mapping ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained Loosely related Only shares CSF ID.AM-02: related, not a mapping
ISO 27001	A.5.19 A.5.20 A.5.21 A.5.22 A.5.23	Information security in supplier relationships; Addressing information security within supplier agreements…	Crosswalk	Same topic: Supply Chain Risk, Vendor Risk Mgmt, Cloud Security 17 loosely related (not mappings) A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-03, GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-02, GV.OC-03, GV.SC-05, GV.SC-06: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 8.1 Operational planning and control Loosely related Only shares CSF GV.OC-02, GV.SC-01: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF GV.SC-01: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF GV.OC-05: related, not a mapping …and 9 more in the downloads
CIS v8.1	CIS 15.1 CIS 15.2 CIS 15.3 CIS 15.5 CIS 15.6 CIS 15.4 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Establish and Maintain a Service Provider Management Policy…	Crosswalk	Same topic: Cloud Security, Vendor Risk Mgmt, Supply Chain Risk 8 loosely related (not mappings) CIS 2.1 Establish and Maintain a Software Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 16.4 Establish and Manage an Inventory of Third-Party Software Components Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Supply Chain Risk, Cloud Security, Vendor Risk Mgmt (editorial pick) 4 loosely related (not mappings) CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-05: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03: related, not a mapping
CMMC	AC.L2-3.1.20	External Connections	Crosswalk	Same topic: Cloud Security 5 loosely related (not mappings) RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.OC-02, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping AC.L2-3.1.21 Portable Storage Use Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF GV.SC-08: related, not a mapping IR.L2-3.6.2 Incident Reporting Loosely related Only shares CSF GV.SC-08: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF GV.OC-03: related, not a mapping
800-53	AC-20 PM-30 SA-4 SA-9 SR-2 SR-3 SR-6 SR-11	Use of External Systems; Supply Chain Risk Management Strategy…	Crosswalk	Same topic: Cloud Security, Supply Chain Risk, Vendor Risk Mgmt 16 loosely related (not mappings) SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.OC-02, GV.OC-05, GV.SC-05, GV.SC-06…: related, not a mapping PM-9 Risk Management Strategy Loosely related Only shares CSF GV.OC-02, GV.SC-09: related, not a mapping PM-28 Risk Framing Loosely related Only shares CSF GV.OC-03, GV.SC-09: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OC-05, GV.SC-09: related, not a mapping RA-9 Criticality Analysis Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping SR-8 Notification Agreements Loosely related Only shares CSF GV.OC-02, GV.SC-08: related, not a mapping CM-8 System Component Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping PM-5 System Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping …and 8 more in the downloads
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Crosswalk	Same topic: Cloud Security, Vendor Risk Mgmt 31 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF GV.OC-03, GV.SC-08: related, not a mapping §164.308(a)(7) Contingency Plan Loosely related Only shares CSF GV.OC-03, GV.SC-08: related, not a mapping §164.310(d) Device and Media Controls Loosely related Only shares CSF GV.OC-03, ID.AM-02: related, not a mapping …and 23 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Supply Chain Risk, Cloud Security, Vendor Risk Mgmt (editorial pick) 2 loosely related (not mappings) Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Crosswalk	Same topic: Supply Chain Risk, Vendor Risk Mgmt, Cloud Security 6 loosely related (not mappings) 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-03, GV.OC-05, ID.RA-10: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-02, GV.OC-03: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping 3.1 Incident handling policy Loosely related Only shares CSF GV.SC-08: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.SC-08: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
DORA	Art.28(2)Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.29(1)Art.29(2)Art.30(2)Art.30(3)	General principles; General principles…	Editorial	Same topic: Supply Chain Risk, Vendor Risk Mgmt, Cloud Security (editorial pick) 7 loosely related (not mappings) Art.8(1) Identification Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.11(5) Response and recovery Loosely related Only shares CSF GV.OC-05: related, not a mapping
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) 3 loosely related (not mappings) Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Cloud Security (editorial pick) 1 loosely related (not mappings) CE 3 Security Update Management Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.