PCI DSS · Requirement 12: Support information security with organizational policies and programs
12.8.5
Responsibilities split with each provider documented
frameworkPCI DSS v4.0.1
sectionRequirement 12: Support information security with organizational policies and programs
csf 2.0GV.OC-02 GV.OC-03 GV.RM-05 GV.SC-01 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-08 GV.SC-09 GV.SC-10 ID.AM-04 RS.CO-02
topicsCloud Security, Vendor Risk Mgmt
frameworks7 5 0
Official text · not licensableSummary (ControlMapping's wording): Responsibilities split with each provider documented. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-06GV.SC-04GV.SC-06GV.SC-07ID.AM-04ID.RA-10PR.IR-01PR.PS-01 | External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality… | Crosswalk | Same topic: Vendor Risk Mgmt, Cloud Security9 loosely related (not mappings)GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered Only shares CSF GV.OC-02: related, not a mapping GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Only shares CSF GV.OC-03: related, not a mapping GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties Only shares CSF GV.RM-05: related, not a mapping GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders Only shares CSF GV.SC-01: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Only shares CSF GV.SC-05: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Only shares CSF GV.SC-08: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Only shares CSF GV.SC-10: related, not a mapping …and 1 more in the downloads |
| ISO 27001 | A.5.19A.5.20A.5.22A.5.23 | Information security in supplier relationships; Addressing information security within supplier agreements… | Crosswalk | Same topic: Vendor Risk Mgmt, Cloud Security16 loosely related (not mappings)Clause 6.1.1 General Only shares CSF GV.RM-05, GV.SC-04, GV.SC-07, GV.SC-09…: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.OC-03, GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.OC-02, GV.OC-03, GV.SC-05, GV.SC-06: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF GV.RM-05, GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Only shares CSF GV.SC-01, GV.SC-09, GV.SC-10: related, not a mapping A.5.26 Response to information security incidents Only shares CSF GV.SC-08, RS.CO-02: related, not a mapping …and 8 more in the downloads |
| CIS v8.1 | CIS 15.1CIS 15.3CIS 15.5CIS 15.6CIS 15.4CIS 15.7 | Establish and Maintain an Inventory of Service Providers; Classify Service Providers… | Crosswalk | Same topic: Cloud Security, Vendor Risk Mgmt10 loosely related (not mappings)CIS 15.2 Establish and Maintain a Service Provider Management Policy Only shares CSF GV.SC-01: related, not a mapping CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Only shares CSF RS.CO-02: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Only shares CSF ID.AM-04: related, not a mapping …and 2 more in the downloads |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick)4 loosely related (not mappings)CC4.1 Ongoing and/or separate evaluations of controls Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Only shares CSF GV.OC-03: related, not a mapping CC6.1 Logical access security over information assets Only shares CSF ID.AM-04: related, not a mapping |
| CMMC | AC.L2-3.1.20 | External Connections | Crosswalk | Same topic: Cloud Security7 loosely related (not mappings)RA.L2-3.11.1 Risk Assessments Only shares CSF GV.OC-02, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping |
| 800-53 | AC-20SA-4SA-9SR-6 | Use of External Systems; Acquisition Process… | Crosswalk | Same topic: Cloud Security, Vendor Risk Mgmt19 loosely related (not mappings)SR-3 Supply Chain Controls and Processes Only shares CSF GV.OC-02, GV.SC-01, GV.SC-05, GV.SC-07…: related, not a mapping SR-2 Supply Chain Risk Management Plan Only shares CSF GV.SC-01, GV.SC-08, GV.SC-09, GV.SC-10…: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Only shares CSF GV.OC-02, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping PM-30 Supply Chain Risk Management Strategy Only shares CSF GV.OC-02, GV.RM-05, GV.SC-01, GV.SC-09: related, not a mapping …and 11 more in the downloads |
| HIPAA | §164.308(b)(1)§164.314(a) | Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements | Crosswalk | Same topic: Cloud Security, Vendor Risk Mgmt33 loosely related (not mappings)§164.314(a)(2)(i) Business Associate Contracts Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.308(a)(6) Security Incident Procedures Only shares CSF GV.OC-03, GV.SC-08, RS.CO-02: related, not a mapping §164.316(a) Policies and Procedures Only shares CSF GV.OC-03, GV.SC-09, GV.SC-10: related, not a mapping …and 25 more in the downloads |
| GDPR | Art.28(1)Art.28(3) | Processor; Processor | Editorial | Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick)4 loosely related (not mappings)Art.5(2) Principles relating to processing of personal data Only shares CSF GV.OC-03: related, not a mapping Art.33(1) Notification of a personal data breach to the supervisory authority Only shares CSF RS.CO-02: related, not a mapping Art.34(1) Communication of a personal data breach to the data subject Only shares CSF RS.CO-02: related, not a mapping |
| NIS2 | 5.15.26.1 | Supply chain security policy; Directory of suppliers and service providers… | Crosswalk | Same topic: Vendor Risk Mgmt, Cloud Security9 loosely related (not mappings)1.1 Policy on the security of network and information systems Only shares CSF GV.OC-02, GV.OC-03: related, not a mapping …and 1 more in the downloads |
| Essential Eight | ISM-0123ISM-0140ISM-1807 | Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or…… | No mapping. Only shares CSF RS.CO-02, ID.AM-04: related, not a mapping | |
| DORA | Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3) | General principles; General principles… | Editorial | Same topic: Vendor Risk Mgmt, Cloud Security (editorial pick)13 loosely related (not mappings)Art.29(1) Preliminary assessment of ICT concentration risk at entity level Only shares CSF GV.SC-01, GV.SC-05, GV.SC-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Only shares CSF GV.SC-01, GV.SC-05, GV.SC-09: related, not a mapping …and 5 more in the downloads |
| CPS 234 | Para 16Para 22Para 28Para 34 | Assess third parties' information security capability; Evaluate the design of third parties' controls… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)5 loosely related (not mappings)Para 20 Classify information assets by criticality and sensitivity Only shares CSF ID.AM-04: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Only shares CSF GV.OC-03: related, not a mapping Para 35 Notify APRA of material incidents within 72 hours Only shares CSF RS.CO-02: related, not a mapping Para 36 Notify APRA of material control weaknesses within 10 business days Only shares CSF RS.CO-02: related, not a mapping |
| Cyber Essentials | CE 4 | User Access Control | Editorial | Same topic: Cloud Security (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.