PCI DSS · Requirement 6: Develop and maintain secure systems and software
6.2.3.1
Manual code reviews approved by someone else
frameworkPCI DSS v4.0.1
sectionRequirement 6: Develop and maintain secure systems and software
csf 2.0ID.AM-08
topics—
frameworks0 0 0
Official text · not licensableSummary (ControlMapping's wording): Manual code reviews approved by someone else. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycles | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| ISO 27001 | A.5.8A.5.9A.5.11A.5.12 | Information security in project management; Inventory of information and other associated assets… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| CIS v8.1 | CIS 1.1CIS 3.5CIS 1.2CIS 1.3 | Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data… | No mapping. Only shares CSF ID.AM-08: related, not a mapping+5 more loosely related (not mappings)CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads | |
| SOC 2 | CC6.1 | Logical access security over information assets | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| CMMC | CA.L2-3.12.4MA.L2-3.7.1MA.L2-3.7.3SC.L2-3.13.2 | System Security Plan; Perform Maintenance… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| 800-53 | CM-9CM-13MA-2MA-6 | Configuration Management Plan; Data Action Mapping… | No mapping. Only shares CSF ID.AM-08: related, not a mapping+11 more loosely related (not mappings)PM-22 Personally Identifiable Information Quality Management Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads | |
| HIPAA | §164.308(a)(1)(ii)(B)§164.308(b)(4)§164.310(a)(2)(ii)§164.310(a)(2)(iv) | Risk Management; Written Contract or Other Arrangement… | No mapping. Only shares CSF ID.AM-08: related, not a mapping+10 more loosely related (not mappings)§164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF ID.AM-08: related, not a mapping …and 6 more in the downloads | |
| GDPR | Art.30(1) | Records of processing activities | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| NIS2 | 6.212.4 | Secure development life cycle; Asset inventory | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| DORA | Art.8(1)Art.8(4)Art.8(6) | Identification; Identification… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| CPS 234 | Para 20 | Classify information assets by criticality and sensitivity | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| Cyber Essentials | CE 3 | Security Update Management | No mapping. Only shares CSF ID.AM-08: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.