PCI DSS · Requirement 12: Support information security with organizational policies and programs
12.9.1
Service providers acknowledge responsibilities to customers
frameworkPCI DSS v4.0.1
sectionRequirement 12: Support information security with organizational policies and programs
csf 2.0GV.OC-02 GV.OC-03 GV.OC-05 GV.RM-05 GV.SC-01 GV.SC-05 GV.SC-07 GV.SC-08
topics—
frameworks0 0 2
Official text · not licensableSummary (ControlMapping's wording): Service providers acknowledge responsibilities to customers. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.OC-02GV.OC-03GV.OC-05GV.RM-05 | Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered; Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed… | No mapping. Only shares CSF GV.OC-02, GV.OC-03, GV.OC-05, GV.RM-05: related, not a mapping+4 more loosely related (not mappings)GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders Only shares CSF GV.SC-01: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Only shares CSF GV.SC-05: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Only shares CSF GV.SC-07: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Only shares CSF GV.SC-08: related, not a mapping | |
| ISO 27001 | A.5.19A.5.20A.5.31Clause 4.2 | Information security in supplier relationships; Addressing information security within supplier agreements… | No mapping. Only shares CSF GV.RM-05, GV.SC-01, GV.SC-05, GV.SC-07…: related, not a mapping+16 more loosely related (not mappings)A.5.22 Monitoring, review and change management of supplier services Only shares CSF GV.SC-01, GV.SC-07: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF GV.RM-05, GV.SC-07: related, not a mapping …and 12 more in the downloads | |
| CIS v8.1 | CIS 15.4CIS 15.2CIS 15.6CIS 15.7 | Ensure Service Provider Contracts Include Security Requirements; Establish and Maintain a Service Provider Management Policy… | No mapping. Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-01: related, not a mapping | |
| SOC 2 | CC9.2CC3.1CC4.1CC4.2 | Managing vendor and business partner risk; Objectives specified clearly enough to identify risks… | No mapping. Only shares CSF GV.SC-01, GV.SC-05, GV.SC-07, GV.OC-05…: related, not a mapping | |
| CMMC | RA.L2-3.11.1IR.L2-3.6.1IR.L2-3.6.2CA.L2-3.12.1 | Risk Assessments; Incident Handling… | No mapping. Only shares CSF GV.OC-02, GV.SC-05, GV.SC-07, GV.SC-08…: related, not a mapping | |
| 800-53 | SR-3PM-30SA-9SA-4 | Supply Chain Controls and Processes; Supply Chain Risk Management Strategy… | No mapping. Only shares CSF GV.OC-02, GV.SC-01, GV.SC-05, GV.SC-07…: related, not a mapping | |
| HIPAA | §164.308(b)(1)§164.308(b)(4)§164.314(a)§164.314(a)(2)(i) | Business Associate Contracts and Other Arrangements; Written Contract or Other Arrangement… | No mapping. Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07, GV.SC-08: related, not a mapping+26 more loosely related (not mappings)§164.314(a)(2)(ii) Other Arrangements Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07, GV.SC-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07, GV.SC-08: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07, GV.SC-08: related, not a mapping §164.308(a)(6) Security Incident Procedures Only shares CSF GV.OC-03, GV.SC-08: related, not a mapping …and 22 more in the downloads | |
| GDPR | Art.28(1)Art.5(2)Art.28(3) | Processor; Principles relating to processing of personal data… | No mapping. Only shares CSF GV.SC-01, GV.SC-05, GV.SC-07, GV.OC-03: related, not a mapping | |
| NIS2 | 5.11.113.13.1 | Supply chain security policy; Policy on the security of network and information systems… | No mapping. Only shares CSF GV.OC-03, GV.OC-05, GV.SC-01, GV.SC-05…: related, not a mapping+3 more loosely related (not mappings)2.3 Independent review of information and network security Only shares CSF GV.OC-03: related, not a mapping | |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.28(2)Art.29(1)Art.29(2)Art.5(2)(f) | General principles; Preliminary assessment of ICT concentration risk at entity level… | No mapping. Only shares CSF GV.SC-01, GV.SC-05, GV.OC-03: related, not a mapping+10 more loosely related (not mappings)…and 6 more in the downloads | |
| CPS 234 | Para 16Para 22Para 34Para 28 | Assess third parties' information security capability; Evaluate the design of third parties' controls… | No mapping. Only shares CSF GV.SC-01, GV.SC-05, GV.SC-07, GV.OC-03: related, not a mapping | |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.