PCI DSS · Requirement 6: Develop and maintain secure systems and software

Bespoke and custom software developed securely

frameworkPCI DSS v4.0.1 sectionRequirement 6: Develop and maintain secure systems and software csf 2.0ID.AM-08 PR.PS-06 topicsSecure Development frameworks0 8 0

Official text · not licensableSummary (ControlMapping's wording): Bespoke and custom software developed securely. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 6.2.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.PS-06	Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle	Editorial	Same topic: Secure Development (editorial pick) 1 loosely related (not mappings) ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Loosely related Only shares CSF ID.AM-08: related, not a mapping
ISO 27001	A.8.25 A.8.26 A.8.28 A.8.29	Secure development life cycle; Application security requirements…	Editorial	Same topic: Secure Development (editorial pick) 11 loosely related (not mappings) A.5.8 Information security in project management Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.11 Return of assets Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.12 Classification of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-08: related, not a mapping A.7.10 Storage media Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 3 more in the downloads
CIS v8.1	CIS 16.1 CIS 16.2 CIS 16.3 CIS 16.5 CIS 16.8 CIS 16.9 CIS 16.11 CIS 16.12 CIS 16.13 CIS 16.14	Establish and Maintain a Secure Application Development Process; Establish and Maintain a Process to Accept and Address Software Vulnerabilities…	Editorial	Same topic: Secure Development (editorial pick) 12 loosely related (not mappings) CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 4 more in the downloads
SOC 2	CC8.1	Change management for infrastructure, data and software	Editorial	Same topic: Secure Development (editorial pick) 2 loosely related (not mappings) CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-08: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.PS-06: related, not a mapping
CMMC	SC.L2-3.13.2	Security Engineering	Editorial	Same topic: Secure Development (editorial pick) 3 loosely related (not mappings) CA.L2-3.12.4 System Security Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.1 Perform Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.3 Equipment Sanitization Loosely related Only shares CSF ID.AM-08: related, not a mapping
800-53	SA-3 SA-8 SA-11 SA-15	System Development Life Cycle; Security and Privacy Engineering Principles…	Editorial	Same topic: Secure Development (editorial pick) 17 loosely related (not mappings) CM-9 Configuration Management Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping CM-13 Data Action Mapping Loosely related Only shares CSF ID.AM-08: related, not a mapping MA-2 Controlled Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA-6 Timely Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping PL-2 System Security and Privacy Plans Loosely related Only shares CSF ID.AM-08: related, not a mapping PM-22 Personally Identifiable Information Quality Management Loosely related Only shares CSF ID.AM-08: related, not a mapping PM-23 Data Governance Body Loosely related Only shares CSF ID.AM-08: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads
HIPAA	§164.308(a)(1)(ii)(B)§164.308(b)(4)§164.310(a)(2)(ii)§164.310(a)(2)(iv)	Risk Management; Written Contract or Other Arrangement…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping +10 more loosely related (not mappings) §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(b) Requirements for Group Health Plans Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 6 more in the downloads
GDPR	Art.25(1)	Data protection by design and by default	Editorial	Same topic: Secure Development (editorial pick) 1 loosely related (not mappings) Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-08: related, not a mapping
NIS2	6.2	Secure development life cycle	Editorial	Same topic: Secure Development (editorial pick) 1 loosely related (not mappings) 12.4 Asset inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.8(1)Art.8(4)Art.8(6)	Identification; Identification…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.