PCI DSS · Requirement 12: Support information security with organizational policies and programs
12.8.3
Due diligence before engaging service providers
frameworkPCI DSS v4.0.1
sectionRequirement 12: Support information security with organizational policies and programs
csf 2.0GV.RM-03 GV.RM-06 GV.SC-01 GV.SC-02 GV.SC-03 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-10 ID.AM-04 ID.RA-10
topicsVendor Risk Mgmt
frameworks6 4 0
Official text · not licensableSummary (ControlMapping's wording): Due diligence before engaging service providers. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-06GV.SC-04GV.SC-06GV.SC-07ID.RA-10 | External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality… | Crosswalk | Same topic: Vendor Risk Mgmt8 loosely related (not mappings)GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes Only shares CSF GV.RM-03: related, not a mapping GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated Only shares CSF GV.RM-06: related, not a mapping GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders Only shares CSF GV.SC-01: related, not a mapping GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally Only shares CSF GV.SC-02: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Only shares CSF GV.SC-03: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Only shares CSF GV.SC-05: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Only shares CSF GV.SC-10: related, not a mapping ID.AM-04 Inventories of services provided by suppliers are maintained Only shares CSF ID.AM-04: related, not a mapping |
| ISO 27001 | A.5.19A.5.20A.5.22 | Information security in supplier relationships; Addressing information security within supplier agreements… | Crosswalk | Same topic: Vendor Risk Mgmt11 loosely related (not mappings)A.5.1 Policies for information security Only shares CSF GV.RM-03, GV.RM-06, GV.SC-01, GV.SC-03: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.RM-06, GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF GV.RM-03, GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Only shares CSF GV.SC-01, GV.SC-03, GV.SC-10: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.SC-05, GV.SC-06: related, not a mapping Clause 8.1 Operational planning and control Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping …and 3 more in the downloads |
| CIS v8.1 | CIS 15.1CIS 15.3CIS 15.5CIS 15.6CIS 15.4CIS 15.7 | Establish and Maintain an Inventory of Service Providers; Classify Service Providers… | Crosswalk | Same topic: Vendor Risk Mgmt8 loosely related (not mappings)CIS 15.2 Establish and Maintain a Service Provider Management Policy Only shares CSF GV.SC-01: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Only shares CSF ID.AM-04: related, not a mapping CIS 16.4 Establish and Manage an Inventory of Third-Party Software Components Only shares CSF ID.AM-04: related, not a mapping |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)4 loosely related (not mappings)CC3.1 Objectives specified clearly enough to identify risks Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping CC5.1 Control activities that mitigate risks Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping CC9.1 Mitigating risks from business disruptions Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping CC6.1 Logical access security over information assets Only shares CSF ID.AM-04: related, not a mapping |
| CMMC | RA.L2-3.11.1AC.L2-3.1.20AC.L2-3.1.21RA.L2-3.11.2 | Risk Assessments; External Connections… | No mapping. Only shares CSF GV.RM-06, GV.SC-03, GV.SC-04, GV.SC-05…: related, not a mapping+1 more loosely related (not mappings) | |
| 800-53 | SA-4SA-9SR-6 | Acquisition Process; External System Services… | Crosswalk | Same topic: Vendor Risk Mgmt16 loosely related (not mappings)SR-2 Supply Chain Risk Management Plan Only shares CSF GV.RM-03, GV.SC-01, GV.SC-02, GV.SC-03…: related, not a mapping SR-3 Supply Chain Controls and Processes Only shares CSF GV.SC-01, GV.SC-02, GV.SC-03, GV.SC-05…: related, not a mapping PM-30 Supply Chain Risk Management Strategy Only shares CSF GV.RM-03, GV.RM-06, GV.SC-01, GV.SC-03: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Only shares CSF GV.SC-02, GV.SC-05, GV.SC-06, GV.SC-10: related, not a mapping …and 8 more in the downloads |
| HIPAA | §164.308(b)(1)§164.314(a) | Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements | Crosswalk | Same topic: Vendor Risk Mgmt30 loosely related (not mappings)§164.308(b)(4) Written Contract or Other Arrangement Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.308(a)(1)(ii)(B) Risk Management Only shares CSF GV.RM-03, GV.RM-06, GV.SC-03, GV.SC-10: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Only shares CSF GV.RM-06, GV.SC-03, GV.SC-10: related, not a mapping §164.316(a) Policies and Procedures Only shares CSF GV.RM-06, GV.SC-03, GV.SC-10: related, not a mapping …and 22 more in the downloads |
| GDPR | Art.28(1)Art.28(3) | Processor; Processor | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)3 loosely related (not mappings)Art.24(1) Responsibility of the controller Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping |
| NIS2 | 5.15.26.1 | Supply chain security policy; Directory of suppliers and service providers… | Crosswalk | Same topic: Vendor Risk Mgmt |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | No mapping. Only shares CSF ID.AM-04: related, not a mapping | |
| DORA | Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3) | General principles; General principles… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)11 loosely related (not mappings)Art.29(1) Preliminary assessment of ICT concentration risk at entity level Only shares CSF GV.SC-01, GV.SC-03, GV.SC-05: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Only shares CSF GV.SC-01, GV.SC-03, GV.SC-05: related, not a mapping Art.16(1) Simplified ICT risk management framework Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.24(1) General requirements for the performance of digital operational resilience testing Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping …and 3 more in the downloads |
| CPS 234 | Para 16Para 22Para 28Para 34 | Assess third parties' information security capability; Evaluate the design of third parties' controls… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)5 loosely related (not mappings)Para 13 Board ultimately responsible for information security Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 15 Maintain a capability commensurate with threats Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 27 Systematic testing programme for control effectiveness Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 31 Review the testing programme at least annually Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 20 Classify information assets by criticality and sensitivity Only shares CSF ID.AM-04: related, not a mapping |
| Cyber Essentials | CE 3CE 4 | Security Update Management; User Access Control | No mapping. Only shares CSF ID.AM-04: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.