PCI DSS · Requirement 5: Protect all systems and networks from malicious software

Re-evaluation frequency set by targeted risk analysis

frameworkPCI DSS v4.0.1 sectionRequirement 5: Protect all systems and networks from malicious software csf 2.0GV.RM-03 GV.RM-06 PR.IR-01 topics— frameworks0 0 1

Official text · not licensableSummary (ControlMapping's wording): Re-evaluation frequency set by targeted risk analysis. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 5.2.3.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RM-03 GV.RM-06 PR.IR-01	Cybersecurity risk management activities and outcomes are included in enterprise risk management processes; A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, PR.IR-01: related, not a mapping
ISO 27001	A.5.1 A.8.20 A.8.21 A.8.22	Policies for information security; Networks security…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, PR.IR-01: related, not a mapping +3 more loosely related (not mappings) A.8.23 Web filtering Loosely related Only shares CSF PR.IR-01: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.RM-06: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.RM-03: related, not a mapping
CIS v8.1	CIS 3.12 CIS 12.2 CIS 4.4 CIS 4.5	Segment Data Processing and Storage Based on Sensitivity; Establish and Maintain a Secure Network Architecture…	Loosely related	No mapping. Only shares CSF PR.IR-01: related, not a mapping +14 more loosely related (not mappings) CIS 4.9 Configure Trusted DNS Servers on Enterprise Assets Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 8.6 Collect DNS Query Audit Logs Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 9.2 Use DNS Filtering Services Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 9.3 Maintain and Enforce Network-Based URL Filters Loosely related Only shares CSF PR.IR-01: related, not a mapping …and 10 more in the downloads
SOC 2	CC3.1 CC5.1 CC9.1 CC6.6	Objectives specified clearly enough to identify risks; Control activities that mitigate risks…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, PR.IR-01: related, not a mapping +1 more loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF PR.IR-01: related, not a mapping
CMMC	AC.L2-3.1.2 AC.L2-3.1.3 RA.L2-3.11.1 SC.L2-3.13.1	Transaction & Function Control; Control CUI Flow…	Loosely related	No mapping. Only shares CSF PR.IR-01, GV.RM-06: related, not a mapping +5 more loosely related (not mappings) SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.IR-01: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF PR.IR-01: related, not a mapping SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.IR-01: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Loosely related Only shares CSF PR.IR-01: related, not a mapping …and 1 more in the downloads
800-53	PM-9 PM-30 AC-3 AC-4	Risk Management Strategy; Supply Chain Risk Management Strategy…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, PR.IR-01: related, not a mapping +14 more loosely related (not mappings) PM-3 Information Security and Privacy Resources Loosely related Only shares CSF GV.RM-03: related, not a mapping PM-18 Privacy Program Plan Loosely related Only shares CSF GV.RM-06: related, not a mapping PM-28 Risk Framing Loosely related Only shares CSF GV.RM-06: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF GV.RM-06: related, not a mapping …and 10 more in the downloads
HIPAA	§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(A)§164.308(a)(3)§164.308(a)(3)(ii)(A)	Risk Management; Risk Analysis…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, PR.IR-01: related, not a mapping +6 more loosely related (not mappings) §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF PR.IR-01: related, not a mapping §164.310(b) Workstation Use Loosely related Only shares CSF PR.IR-01: related, not a mapping §164.312(a) Access Control Loosely related Only shares CSF PR.IR-01: related, not a mapping §164.312(a)(2)(i) Unique User Identification Loosely related Only shares CSF PR.IR-01: related, not a mapping …and 2 more in the downloads
GDPR	Art.24(1)Art.32(2)Art.28(1)	Responsibility of the controller; Security of processing…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, PR.IR-01: related, not a mapping
NIS2	2.1 1.1 6.7 6.8	Risk management framework; Policy on the security of network and information systems…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, PR.IR-01: related, not a mapping +1 more loosely related (not mappings) 7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures Loosely related Only shares CSF GV.RM-06: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(a)Art.6(1)Art.6(8)Art.16(1)	Governance and organisation; ICT risk management framework…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping +4 more loosely related (not mappings) Art.24(1) General requirements for the performance of digital operational resilience testing Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.9(4)(b) Protection and prevention Loosely related Only shares CSF PR.IR-01: related, not a mapping Art.28(8) General principles Loosely related Only shares CSF PR.IR-01: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF PR.IR-01: related, not a mapping
CPS 234	Para 13 Para 15 Para 27 Para 31	Board ultimately responsible for information security; Maintain a capability commensurate with threats…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
Cyber Essentials	CE 1 CE 4	Firewalls; User Access Control	Loosely related	No mapping. Only shares CSF PR.IR-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.