PCI DSS · Requirement 12: Support information security with organizational policies and programs

Service provider compliance monitored annually

frameworkPCI DSS v4.0.1 sectionRequirement 12: Support information security with organizational policies and programs csf 2.0DE.CM-06 GV.OC-03 GV.OC-05 GV.OV-02 GV.RM-05 GV.SC-01 GV.SC-02 GV.SC-04 GV.SC-07 GV.SC-09 ID.AM-04 ID.IM-02 RC.CO-03 RS.CO-03 topicsVendor Risk Mgmt frameworks6 4 0

Official text · not licensableSummary (ControlMapping's wording): Service provider compliance monitored annually. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 12.8.4 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Crosswalk	Same topic: Vendor Risk Mgmt 10 loosely related (not mappings) GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated Loosely related Only shares CSF GV.OC-05: related, not a mapping GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks Loosely related Only shares CSF GV.OV-02: related, not a mapping GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties Loosely related Only shares CSF GV.RM-05: related, not a mapping GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders Loosely related Only shares CSF GV.SC-01: related, not a mapping GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally Loosely related Only shares CSF GV.SC-02: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping ID.AM-04 Inventories of services provided by suppliers are maintained Loosely related Only shares CSF ID.AM-04: related, not a mapping …and 2 more in the downloads
ISO 27001	A.5.19 A.5.20 A.5.22	Information security in supplier relationships; Addressing information security within supplier agreements…	Crosswalk	Same topic: Vendor Risk Mgmt 22 loosely related (not mappings) Clause 6.1.1 General Loosely related Only shares CSF GV.RM-05, GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-02, GV.RM-05, GV.SC-01: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.RM-05, GV.SC-04, GV.SC-07: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-01, GV.SC-09: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-03, GV.SC-07: related, not a mapping A.5.35 Independent review of information security Loosely related Only shares CSF GV.OV-02, ID.IM-02: related, not a mapping A.5.36 Compliance with policies, rules and standards for information security Loosely related Only shares CSF GV.OC-03, GV.OV-02: related, not a mapping …and 14 more in the downloads
CIS v8.1	CIS 15.1 CIS 15.3 CIS 15.5 CIS 15.6 CIS 15.4 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Classify Service Providers…	Crosswalk	Same topic: Vendor Risk Mgmt 10 loosely related (not mappings) CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF DE.CM-06, GV.SC-01: related, not a mapping CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Loosely related Only shares CSF RS.CO-03: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-04: related, not a mapping …and 2 more in the downloads
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 6 loosely related (not mappings) CC2.3 Communication with external parties Loosely related Only shares CSF RC.CO-03, RS.CO-03: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-05: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-04: related, not a mapping CC7.5 Recovering from identified security incidents Loosely related Only shares CSF RC.CO-03: related, not a mapping
CMMC	RA.L2-3.11.1 IR.L2-3.6.1 CA.L2-3.12.1 CA.L2-3.12.3	Risk Assessments; Incident Handling…	Loosely related	No mapping. Only shares CSF GV.OV-02, GV.SC-04, GV.SC-07, GV.SC-09…: related, not a mapping +6 more loosely related (not mappings) CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-06, ID.IM-02: related, not a mapping IR.L2-3.6.2 Incident Reporting Loosely related Only shares CSF RC.CO-03, RS.CO-03: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.CM-06, ID.IM-02: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.CM-06, ID.IM-02: related, not a mapping …and 2 more in the downloads
800-53	SA-4 SA-9 SR-6	Acquisition Process; External System Services…	Crosswalk	Same topic: Vendor Risk Mgmt 21 loosely related (not mappings) PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.OC-05, GV.OV-02, GV.RM-05, GV.SC-01…: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-01, GV.SC-02, GV.SC-07, GV.SC-09…: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OC-05, GV.OV-02, GV.SC-09, ID.IM-02: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-01, GV.SC-02, GV.SC-09, ID.AM-04: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.OC-05, GV.SC-02, GV.SC-09, ID.IM-02: related, not a mapping IR-4 Incident Handling Loosely related Only shares CSF ID.IM-02, RC.CO-03, RS.CO-03: related, not a mapping PM-9 Risk Management Strategy Loosely related Only shares CSF GV.OV-02, GV.RM-05, GV.SC-09: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.OV-02, GV.SC-09, ID.IM-02: related, not a mapping …and 13 more in the downloads
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Crosswalk	Same topic: Vendor Risk Mgmt 33 loosely related (not mappings) §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF DE.CM-06, GV.OC-05, GV.SC-04, GV.SC-07…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF DE.CM-06, GV.OC-05, GV.SC-04, GV.SC-07…: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF DE.CM-06, GV.OC-05, GV.SC-04, GV.SC-07…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF DE.CM-06, GV.OC-05, GV.SC-04, GV.SC-07…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF DE.CM-06, GV.OC-05, GV.SC-04, GV.SC-07…: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF DE.CM-06, ID.IM-02, RC.CO-03, RS.CO-03: related, not a mapping §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF GV.OC-03, ID.IM-02, RC.CO-03, RS.CO-03: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF DE.CM-06, GV.OC-03, ID.IM-02: related, not a mapping …and 25 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 3 loosely related (not mappings) Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-04: related, not a mapping Art.34(1) Communication of a personal data breach to the data subject Loosely related Only shares CSF RC.CO-03: related, not a mapping
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Crosswalk	Same topic: Vendor Risk Mgmt 8 loosely related (not mappings) 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-06, GV.OC-03, GV.OC-05: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03, GV.OV-02: related, not a mapping 3.5 Incident response Loosely related Only shares CSF RC.CO-03, RS.CO-03: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03: related, not a mapping 1.2 Roles, responsibilities and authorities Loosely related Only shares CSF GV.SC-02: related, not a mapping 2.2 Compliance monitoring Loosely related Only shares CSF GV.OV-02: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF RS.CO-03: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-04: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-04: related, not a mapping
DORA	Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3)	General principles; General principles…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 15 loosely related (not mappings) Art.8(1) Identification Loosely related Only shares CSF GV.OC-05, ID.AM-04: related, not a mapping Art.28(2) General principles Loosely related Only shares CSF GV.SC-01, GV.SC-09: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-01, GV.SC-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-01, GV.SC-09: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-04: related, not a mapping …and 7 more in the downloads
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 4 loosely related (not mappings) Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-04: related, not a mapping Para 25 Response plans cover all stages and escalation Loosely related Only shares CSF RS.CO-03: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	CE 3 CE 4	Security Update Management; User Access Control	Loosely related	No mapping. Only shares CSF ID.AM-04: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.