PCI DSS · Requirement 3: Protect stored account data

Account data storage minimised, with retention and disposal

frameworkPCI DSS v4.0.1 sectionRequirement 3: Protect stored account data csf 2.0GV.OC-03 GV.SC-10 ID.AM-07 PR.DS-10 topicsData Protection frameworks7 4 2

Official text · not licensableSummary (ControlMapping's wording): Account data storage minimised, with retention and disposal. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 3.2.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.DS-01 PR.DS-02 PR.DS-10	The confidentiality, integrity, and availability of data-at-rest are protected; The confidentiality, integrity, and availability of data-in-transit are protected…	Crosswalk	Same topic: Data Protection 3 loosely related (not mappings) GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.AM-07 Inventories of data and corresponding metadata for designated data types are maintained Loosely related Only shares CSF ID.AM-07: related, not a mapping
ISO 27001	A.5.14 A.8.10 A.8.11	Information transfer; Information deletion…	Crosswalk	Same topic: Data Protection 26 loosely related (not mappings) A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-03, GV.SC-10: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-03, PR.DS-10: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.DS-10: related, not a mapping A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-07: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-10: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF PR.DS-10: related, not a mapping A.5.15 Access control Loosely related Only shares CSF PR.DS-10: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.SC-10: related, not a mapping …and 18 more in the downloads
CIS v8.1	CIS 3.11 CIS 3.1 CIS 3.4 CIS 3.5 CIS 3.12	Encrypt Sensitive Data at Rest; Establish and Maintain a Data Management Process…	Crosswalk	Same topic: Data Protection 4 loosely related (not mappings) CIS 3.2 Establish and Maintain a Data Inventory Loosely related Only shares CSF ID.AM-07: related, not a mapping CIS 15.7 Securely Decommission Service Providers Loosely related Only shares CSF GV.SC-10: related, not a mapping CIS 3.8 Document Data Flows Loosely related Only shares CSF ID.AM-07: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-10: related, not a mapping
SOC 2	C1.2 CC6.5	Disposing of confidential information; Protection of data when assets are disposed of	Editorial	Same topic: Data Protection (editorial pick) 4 loosely related (not mappings) C1.1 Identifying and protecting confidential information Loosely related Only shares CSF ID.AM-07: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-10: related, not a mapping
CMMC	SC.L2-3.13.16 MP.L2-3.8.3	Data at Rest; Media Disposal	Crosswalk	Same topic: Data Protection 23 loosely related (not mappings) AC.L2-3.1.1 Authorized Access Control Loosely related Only shares CSF PR.DS-10: related, not a mapping AC.L2-3.1.2 Transaction & Function Control Loosely related Only shares CSF PR.DS-10: related, not a mapping AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF PR.DS-10: related, not a mapping AU.L2-3.3.8 Audit Protection Loosely related Only shares CSF PR.DS-10: related, not a mapping AU.L2-3.3.9 Audit Management Loosely related Only shares CSF PR.DS-10: related, not a mapping MP.L2-3.8.9 Protect Backups Loosely related Only shares CSF PR.DS-10: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.SC-10: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF GV.SC-10: related, not a mapping …and 15 more in the downloads
800-53	SC-8 SC-28 SI-7	Transmission Confidentiality and Integrity; Protection of Information at Rest…	Crosswalk	Same topic: Data Protection 37 loosely related (not mappings) AC-2 Account Management Loosely related Only shares CSF PR.DS-10: related, not a mapping AC-3 Access Enforcement Loosely related Only shares CSF PR.DS-10: related, not a mapping AC-4 Information Flow Enforcement Loosely related Only shares CSF PR.DS-10: related, not a mapping AU-9 Protection of Audit Information Loosely related Only shares CSF PR.DS-10: related, not a mapping AU-13 Monitoring for Information Disclosure Loosely related Only shares CSF PR.DS-10: related, not a mapping CA-3 Information Exchange Loosely related Only shares CSF PR.DS-10: related, not a mapping CM-12 Information Location Loosely related Only shares CSF ID.AM-07: related, not a mapping CM-13 Data Action Mapping Loosely related Only shares CSF ID.AM-07: related, not a mapping …and 29 more in the downloads
HIPAA	§164.312(c)§164.310(d)(2)(i)	Integrity; Disposal	Crosswalk	Same topic: Data Protection 44 loosely related (not mappings) §164.308(a)(3) Workforce Security Loosely related Only shares CSF GV.OC-03, PR.DS-10: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF GV.OC-03, PR.DS-10: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF GV.OC-03, PR.DS-10: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF GV.OC-03, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF GV.OC-03, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF GV.OC-03, PR.DS-10: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.SC-10, PR.DS-10: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-10, PR.DS-10: related, not a mapping …and 36 more in the downloads
GDPR	Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)	Principles relating to processing of personal data; Principles relating to processing of personal data…	Editorial	Same topic: Data Protection (editorial pick) 1 loosely related (not mappings) Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping
NIS2	12.2 12.3	Handling of assets; Removable media policy	Crosswalk	Same topic: Data Protection 5 loosely related (not mappings) 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03, GV.SC-10: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-07: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-03: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.9(2)Art.9(3)(c)Art.9(3)(d)	Protection and prevention; Protection and prevention…	Editorial	Same topic: Data Protection (editorial pick) 4 loosely related (not mappings) Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF ID.AM-07: related, not a mapping
CPS 234	Para 21	Timely controls commensurate with risk and asset life-cycle	Editorial	Same topic: Data Protection (editorial pick) 4 loosely related (not mappings) Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-07: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.