PCI DSS · Requirement 12: Support information security with organizational policies and programs

Service providers support customer compliance requests

frameworkPCI DSS v4.0.1 sectionRequirement 12: Support information security with organizational policies and programs csf 2.0GV.OC-02 GV.OC-03 GV.OC-05 GV.RM-05 GV.SC-01 GV.SC-05 GV.SC-07 topics— frameworks0 0 2

Official text · not licensableSummary (ControlMapping's wording): Service providers support customer compliance requests. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 12.9.2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-02 GV.OC-03 GV.OC-05 GV.RM-05	Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered; Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed…	Loosely related	No mapping. Only shares CSF GV.OC-02, GV.OC-03, GV.OC-05, GV.RM-05: related, not a mapping +3 more loosely related (not mappings) GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders Loosely related Only shares CSF GV.SC-01: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Loosely related Only shares CSF GV.SC-05: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Loosely related Only shares CSF GV.SC-07: related, not a mapping
ISO 27001	A.5.19 A.5.20 A.5.31 Clause 4.2	Information security in supplier relationships; Addressing information security within supplier agreements…	Loosely related	No mapping. Only shares CSF GV.RM-05, GV.SC-01, GV.SC-05, GV.SC-07…: related, not a mapping +15 more loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.RM-05, GV.SC-01: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-01, GV.SC-07: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.RM-05, GV.SC-07: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.RM-05, GV.SC-07: related, not a mapping …and 11 more in the downloads
CIS v8.1	CIS 15.4 CIS 15.2 CIS 15.6 CIS 15.7	Ensure Service Provider Contracts Include Security Requirements; Establish and Maintain a Service Provider Management Policy…	Loosely related	No mapping. Only shares CSF GV.SC-05, GV.SC-07, GV.SC-01: related, not a mapping
SOC 2	CC9.2 CC3.1 CC4.1 CC4.2	Managing vendor and business partner risk; Objectives specified clearly enough to identify risks…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-05, GV.SC-07, GV.OC-05…: related, not a mapping
CMMC	RA.L2-3.11.1 CA.L2-3.12.1	Risk Assessments; Security Control Assessment	Loosely related	No mapping. Only shares CSF GV.OC-02, GV.SC-05, GV.SC-07, GV.OC-03: related, not a mapping
800-53	PM-30 SR-3 SA-9 SR-5	Supply Chain Risk Management Strategy; Supply Chain Controls and Processes…	Loosely related	No mapping. Only shares CSF GV.OC-02, GV.OC-05, GV.RM-05, GV.SC-01…: related, not a mapping +12 more loosely related (not mappings) SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.OC-02, GV.SC-05, GV.SC-07: related, not a mapping PM-9 Risk Management Strategy Loosely related Only shares CSF GV.OC-02, GV.RM-05: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF GV.SC-05, GV.SC-07: related, not a mapping PM-11 Mission and Business Process Definition Loosely related Only shares CSF GV.OC-05: related, not a mapping …and 8 more in the downloads
HIPAA	§164.308(b)(1)§164.308(b)(4)§164.314(a)§164.314(a)(2)(i)	Business Associate Contracts and Other Arrangements; Written Contract or Other Arrangement…	Loosely related	No mapping. Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07: related, not a mapping +26 more loosely related (not mappings) §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07: related, not a mapping §164.308(a)(1) Security Management Process Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 22 more in the downloads
GDPR	Art.28(1)Art.5(2)Art.28(3)	Processor; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-05, GV.SC-07, GV.OC-03: related, not a mapping
NIS2	5.1 1.1 13.1 5.2	Supply chain security policy; Policy on the security of network and information systems…	Loosely related	No mapping. Only shares CSF GV.OC-03, GV.OC-05, GV.SC-01, GV.SC-05…: related, not a mapping +1 more loosely related (not mappings) 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.28(2)Art.29(1)Art.29(2)Art.5(2)(f)	General principles; Preliminary assessment of ICT concentration risk at entity level…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-05, GV.OC-03: related, not a mapping +10 more loosely related (not mappings) Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF GV.OC-05: related, not a mapping Art.11(5) Response and recovery Loosely related Only shares CSF GV.OC-05: related, not a mapping …and 6 more in the downloads
CPS 234	Para 16 Para 22 Para 34 Para 28	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-05, GV.SC-07, GV.OC-03: related, not a mapping +2 more loosely related (not mappings) Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.