PCI DSS · Requirement 12: Support information security with organizational policies and programs

Written agreements with service providers

frameworkPCI DSS v4.0.1 sectionRequirement 12: Support information security with organizational policies and programs csf 2.0GV.OC-03 GV.RM-05 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-08 GV.SC-10 ID.RA-10 RC.CO-03 RS.CO-02 RS.CO-03 RS.MA-01 topicsVendor Risk Mgmt frameworks6 4 1

Official text · not licensableSummary (ControlMapping's wording): Written agreements with service providers. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 12.8.2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Crosswalk	Same topic: Vendor Risk Mgmt 9 loosely related (not mappings) GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties Loosely related Only shares CSF GV.RM-05: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Loosely related Only shares CSF GV.SC-05: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Loosely related Only shares CSF GV.SC-08: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping RC.CO-03 Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders Loosely related Only shares CSF RC.CO-03: related, not a mapping RS.CO-02 Internal and external stakeholders are notified of incidents Loosely related Only shares CSF RS.CO-02: related, not a mapping RS.CO-03 Information is shared with designated internal and external stakeholders Loosely related Only shares CSF RS.CO-03: related, not a mapping …and 1 more in the downloads
ISO 27001	A.5.19 A.5.20 A.5.22	Information security in supplier relationships; Addressing information security within supplier agreements…	Crosswalk	Same topic: Vendor Risk Mgmt 13 loosely related (not mappings) A.5.26 Response to information security incidents Loosely related Only shares CSF GV.SC-08, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-03, GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.RM-05, GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.RM-05, GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-03, GV.SC-05, GV.SC-06: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping Clause 7.4 Communication Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03: related, not a mapping A.5.28 Collection of evidence Loosely related Only shares CSF RC.CO-03, RS.MA-01: related, not a mapping …and 5 more in the downloads
CIS v8.1	CIS 15.1 CIS 15.3 CIS 15.5 CIS 15.6 CIS 15.4 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Classify Service Providers…	Crosswalk	Same topic: Vendor Risk Mgmt 8 loosely related (not mappings) CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Loosely related Only shares CSF RS.CO-02, RS.CO-03: related, not a mapping CIS 17.4 Establish and Maintain an Incident Response Process Loosely related Only shares CSF RS.MA-01: related, not a mapping CIS 17.1 Designate Personnel to Manage Incident Handling Loosely related Only shares CSF RS.MA-01: related, not a mapping CIS 17.3 Establish and Maintain an Enterprise Process for Reporting Incidents Loosely related Only shares CSF RS.CO-02: related, not a mapping CIS 17.5 Assign Key Roles and Responsibilities Loosely related Only shares CSF RS.MA-01: related, not a mapping CIS 17.6 Define Mechanisms for Communicating During Incident Response Loosely related Only shares CSF RS.CO-03: related, not a mapping CIS 17.7 Conduct Routine Incident Response Exercises Loosely related Only shares CSF RS.MA-01: related, not a mapping CIS 17.9 Establish and Maintain Security Incident Thresholds Loosely related Only shares CSF RS.MA-01: related, not a mapping
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 6 loosely related (not mappings) CC2.3 Communication with external parties Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03: related, not a mapping CC7.3 Evaluating security events to determine if they are incidents Loosely related Only shares CSF RS.MA-01: related, not a mapping CC7.4 Responding to identified security incidents Loosely related Only shares CSF RS.MA-01: related, not a mapping CC7.5 Recovering from identified security incidents Loosely related Only shares CSF RC.CO-03: related, not a mapping
CMMC	RA.L2-3.11.1 IR.L2-3.6.2 IR.L2-3.6.1 RA.L2-3.11.2	Risk Assessments; Incident Reporting…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping +3 more loosely related (not mappings) RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF GV.SC-10: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF GV.OC-03: related, not a mapping IR.L2-3.6.3 Incident Response Testing Loosely related Only shares CSF RS.MA-01: related, not a mapping
800-53	SA-4 SA-9 SR-6	Acquisition Process; External System Services…	Crosswalk	Same topic: Vendor Risk Mgmt 20 loosely related (not mappings) SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-10…: related, not a mapping SR-8 Notification Agreements Loosely related Only shares CSF GV.SC-08, RC.CO-03, RS.CO-02, RS.CO-03…: related, not a mapping IR-6 Incident Reporting Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping IR-4 Incident Handling Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03: related, not a mapping IR-7 Incident Response Assistance Loosely related Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-10: related, not a mapping RA-9 Criticality Analysis Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-08, GV.SC-10: related, not a mapping …and 12 more in the downloads
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Crosswalk	Same topic: Vendor Risk Mgmt 33 loosely related (not mappings) §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF GV.OC-03, GV.SC-08, RC.CO-03, RS.CO-02…: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping §164.308(a)(6)(ii) Response and Reporting Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping …and 25 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 4 loosely related (not mappings) Art.33(1) Notification of a personal data breach to the supervisory authority Loosely related Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping Art.34(1) Communication of a personal data breach to the data subject Loosely related Only shares CSF RC.CO-03, RS.CO-02: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.33(5) Notification of a personal data breach to the supervisory authority Loosely related Only shares CSF RS.MA-01: related, not a mapping
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Crosswalk	Same topic: Vendor Risk Mgmt 8 loosely related (not mappings) 3.5 Incident response Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping 3.1 Incident handling policy Loosely related Only shares CSF GV.SC-08, RS.MA-01: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF RS.CO-02, RS.CO-03: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-03, ID.RA-10: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03: related, not a mapping 3.3 Event reporting Loosely related Only shares CSF RS.CO-02: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.SC-08: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03: related, not a mapping
Essential Eight	ISM-0123 ISM-0140 ISM-1819	Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or……	Loosely related	No mapping. Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping
DORA	Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3)	General principles; General principles…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 18 loosely related (not mappings) Art.18(1) Classification of ICT-related incidents and cyber threats Loosely related Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.11(2)(b) Response and recovery Loosely related Only shares CSF RS.MA-01: related, not a mapping Art.11(2)(e) Response and recovery Loosely related Only shares CSF RC.CO-03: related, not a mapping Art.11(7) Response and recovery Loosely related Only shares CSF RC.CO-03: related, not a mapping Art.14(1) Communication Loosely related Only shares CSF RS.CO-03: related, not a mapping …and 10 more in the downloads
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 8 loosely related (not mappings) Para 25 Response plans cover all stages and escalation Loosely related Only shares CSF RS.CO-03, RS.MA-01: related, not a mapping Para 23 Detect and respond to incidents in a timely manner Loosely related Only shares CSF RS.MA-01: related, not a mapping Para 24 Maintain information security response plans Loosely related Only shares CSF RS.MA-01: related, not a mapping Para 26 Review and test response plans annually Loosely related Only shares CSF RS.MA-01: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 35 Notify APRA of material incidents within 72 hours Loosely related Only shares CSF RS.CO-02: related, not a mapping Para 36 Notify APRA of material control weaknesses within 10 business days Loosely related Only shares CSF RS.CO-02: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.