PCI DSS · Requirement 6: Develop and maintain secure systems and software
6.2.2
Developers trained in secure software development
frameworkPCI DSS v4.0.1
sectionRequirement 6: Develop and maintain secure systems and software
csf 2.0GV.RR-01 ID.AM-08 PR.AT-02 PR.PS-06
topicsSecure Development
frameworks6 2 0
Official text · not licensableSummary (ControlMapping's wording): Developers trained in secure software development. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.PS-06 | Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | Crosswalk | Same topic: Secure Development3 loosely related (not mappings)GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving Only shares CSF GV.RR-01: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Only shares CSF ID.AM-08: related, not a mapping PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind Only shares CSF PR.AT-02: related, not a mapping |
| ISO 27001 | A.8.25A.8.26A.8.28A.8.29 | Secure development life cycle; Application security requirements… | Crosswalk | Same topic: Secure Development16 loosely related (not mappings)A.5.2 Information security roles and responsibilities Only shares CSF PR.AT-02: related, not a mapping A.5.9 Inventory of information and other associated assets Only shares CSF ID.AM-08: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF ID.AM-08: related, not a mapping …and 8 more in the downloads |
| CIS v8.1 | CIS 16.1CIS 16.2CIS 16.3CIS 16.5CIS 16.8CIS 16.9CIS 16.11CIS 16.12CIS 16.13CIS 16.14 | Establish and Maintain a Secure Application Development Process; Establish and Maintain a Process to Accept and Address Software Vulnerabilities… | Crosswalk | Same topic: Secure Development21 loosely related (not mappings)CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping CIS 14.1 Establish and Maintain a Security Awareness Program Only shares CSF GV.RR-01: related, not a mapping CIS 14.9 Conduct Role-Specific Security Awareness and Skills Training Only shares CSF PR.AT-02: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping …and 13 more in the downloads |
| SOC 2 | CC8.1 | Change management for infrastructure, data and software | Editorial | Same topic: Secure Development (editorial pick)7 loosely related (not mappings)CC1.2 Board independence and oversight of internal control Only shares CSF GV.RR-01: related, not a mapping CC1.3 Structures, reporting lines, authorities and responsibilities Only shares CSF GV.RR-01: related, not a mapping CC1.4 Commitment to attracting, developing and retaining competent people Only shares CSF PR.AT-02: related, not a mapping CC1.5 Accountability for internal control responsibilities Only shares CSF GV.RR-01: related, not a mapping CC2.2 Internal communication of objectives and responsibilities Only shares CSF PR.AT-02: related, not a mapping CC6.1 Logical access security over information assets Only shares CSF ID.AM-08: related, not a mapping CC6.6 Protection against threats from outside system boundaries Only shares CSF PR.PS-06: related, not a mapping |
| CMMC | SC.L2-3.13.2 | Security Engineering | Crosswalk | Same topic: Secure Development4 loosely related (not mappings) |
| 800-53 | SA-3SA-8SA-11SA-15 | System Development Life Cycle; Security and Privacy Engineering Principles… | Crosswalk | Same topic: Secure Development23 loosely related (not mappings)…and 15 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(B)§164.308(a)(2)§164.308(a)(5)§164.308(a)(5)(ii)(A) | Risk Management; Assigned Security Responsibility… | No mapping. Only shares CSF ID.AM-08, GV.RR-01, PR.AT-02: related, not a mapping+16 more loosely related (not mappings)§164.308(a)(5)(ii)(B) Protection from Malicious Software Only shares CSF PR.AT-02: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Only shares CSF ID.AM-08: related, not a mapping …and 12 more in the downloads | |
| GDPR | Art.25(1) | Data protection by design and by default | Editorial | Same topic: Secure Development (editorial pick)4 loosely related (not mappings)Art.37(1) Designation of the data protection officer Only shares CSF GV.RR-01: related, not a mapping |
| NIS2 | 6.2 | Secure development life cycle | Crosswalk | Same topic: Secure Development |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| DORA | Art.5(2)(c)Art.5(3)Art.5(4)Art.6(4) | Governance and organisation; Governance and organisation… | No mapping. Only shares CSF GV.RR-01, PR.AT-02: related, not a mapping+4 more loosely related (not mappings) | |
| CPS 234 | Para 13Para 14Para 20 | Board ultimately responsible for information security; Define information security roles and responsibilities… | No mapping. Only shares CSF GV.RR-01, ID.AM-08: related, not a mapping | |
| Cyber Essentials | CE 3 | Security Update Management | No mapping. Only shares CSF ID.AM-08: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.