PCI DSS · Requirement 5: Protect all systems and networks from malicious software

Scan frequency set by targeted risk analysis

frameworkPCI DSS v4.0.1 sectionRequirement 5: Protect all systems and networks from malicious software csf 2.0GV.RM-03 GV.RM-06 topics— frameworks0 0 3

Official text · not licensableSummary (ControlMapping's wording): Scan frequency set by targeted risk analysis. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 5.3.2.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RM-03 GV.RM-06	Cybersecurity risk management activities and outcomes are included in enterprise risk management processes; A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
ISO 27001	A.5.1 Clause 6.1.2 Clause 6.1.3	Policies for information security; Information security risk assessment…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	CC3.1 CC5.1 CC9.1	Objectives specified clearly enough to identify risks; Control activities that mitigate risks…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
CMMC	RA.L2-3.11.1	Risk Assessments	Loosely related	No mapping. Only shares CSF GV.RM-06: related, not a mapping
800-53	PM-9 PM-30 PM-3 PM-18	Risk Management Strategy; Supply Chain Risk Management Strategy…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping +5 more loosely related (not mappings) PM-28 Risk Framing Loosely related Only shares CSF GV.RM-06: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF GV.RM-06: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.RM-03: related, not a mapping SA-24 Design For Cyber Resiliency Loosely related Only shares CSF GV.RM-03: related, not a mapping …and 1 more in the downloads
HIPAA	§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(A)§164.316(a)	Risk Management; Risk Analysis…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
GDPR	Art.24(1)Art.32(2)	Responsibility of the controller; Security of processing	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
NIS2	2.1 1.1 7.1	Risk management framework; Policy on the security of network and information systems…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(a)Art.6(1)Art.6(8)Art.16(1)	Governance and organisation; ICT risk management framework…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping +1 more loosely related (not mappings) Art.24(1) General requirements for the performance of digital operational resilience testing Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
CPS 234	Para 13 Para 15 Para 27 Para 31	Board ultimately responsible for information security; Maintain a capability commensurate with threats…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.