PCI DSS · Requirement 6: Develop and maintain secure systems and software

Custom code reviewed before release

frameworkPCI DSS v4.0.1 sectionRequirement 6: Develop and maintain secure systems and software csf 2.0GV.SC-03 GV.SC-09 ID.AM-08 PR.PS-06 RC.RP-05 RS.MI-02 topicsSecure Development, API Security frameworks6 2 0

Official text · not licensableSummary (ControlMapping's wording): Custom code reviewed before release. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 6.2.3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-03 PR.IR-01 PR.PS-06	Users, services, and hardware are authenticated; Networks and environments are protected from unauthorized logical access and usage…	Crosswalk	Same topic: API Security, Secure Development 5 loosely related (not mappings) GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Loosely related Only shares CSF ID.AM-08: related, not a mapping RC.RP-05 The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed Loosely related Only shares CSF RC.RP-05: related, not a mapping RS.MI-02 Incidents are eradicated Loosely related Only shares CSF RS.MI-02: related, not a mapping
ISO 27001	A.8.5 A.8.25 A.8.26 A.8.28 A.8.29	Secure authentication; Secure development life cycle…	Crosswalk	Same topic: API Security, Secure Development 18 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.SC-03, GV.SC-09, ID.AM-08: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-09, ID.AM-08: related, not a mapping A.5.26 Response to information security incidents Loosely related Only shares CSF RC.RP-05, RS.MI-02: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF GV.SC-03: related, not a mapping A.5.8 Information security in project management Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 10 more in the downloads
CIS v8.1	CIS 16.1 CIS 16.2 CIS 16.3 CIS 16.5 CIS 16.8 CIS 16.9 CIS 16.10 CIS 16.11 CIS 16.12 CIS 16.13 CIS 16.14	Establish and Maintain a Secure Application Development Process; Establish and Maintain a Process to Accept and Address Software Vulnerabilities…	Crosswalk	Same topic: Secure Development, API Security 13 loosely related (not mappings) CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 15.6 Monitor Service Providers Loosely related Only shares CSF GV.SC-09: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 5 more in the downloads
SOC 2	CC8.1	Change management for infrastructure, data and software	Editorial	Same topic: Secure Development (editorial pick) 8 loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF RC.RP-05: related, not a mapping A1.3 Testing recovery plan procedures Loosely related Only shares CSF RC.RP-05: related, not a mapping CC2.3 Communication with external parties Loosely related Only shares CSF RC.RP-05: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-08: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.PS-06: related, not a mapping CC7.4 Responding to identified security incidents Loosely related Only shares CSF RS.MI-02: related, not a mapping CC7.5 Recovering from identified security incidents Loosely related Only shares CSF RC.RP-05: related, not a mapping
CMMC	SC.L2-3.13.2	Security Engineering	Crosswalk	Same topic: Secure Development 5 loosely related (not mappings) RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping CA.L2-3.12.4 System Security Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF RS.MI-02: related, not a mapping MA.L2-3.7.1 Perform Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.3 Equipment Sanitization Loosely related Only shares CSF ID.AM-08: related, not a mapping
800-53	IA-9 SA-3 SA-8 SA-11 SA-15 SC-5 SI-10	Service Identification and Authentication; System Development Life Cycle…	Crosswalk	Same topic: API Security, Secure Development 31 loosely related (not mappings) PM-9 Risk Management Strategy Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF GV.SC-09, ID.AM-08: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping …and 23 more in the downloads
HIPAA	§164.308(a)(1)(ii)(B)§164.316(a)§164.308(a)(1)(ii)(A)§164.308(a)(6)	Risk Management; Policies and Procedures…	Loosely related	No mapping. Only shares CSF GV.SC-03, GV.SC-09, ID.AM-08, RS.MI-02: related, not a mapping +37 more loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-09, ID.AM-08: related, not a mapping §164.310(a)(2)(ii) Facility Security Plan Loosely related Only shares CSF GV.SC-03, ID.AM-08: related, not a mapping §164.310(a)(2)(iv) Maintenance Records Loosely related Only shares CSF GV.SC-03, ID.AM-08: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF GV.SC-09, ID.AM-08: related, not a mapping …and 33 more in the downloads
GDPR	Art.25(1)	Data protection by design and by default	Editorial	Same topic: Secure Development (editorial pick) 4 loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.32(1)(c) Security of processing Loosely related Only shares CSF RC.RP-05: related, not a mapping Art.34(1) Communication of a personal data breach to the data subject Loosely related Only shares CSF RC.RP-05: related, not a mapping
NIS2	6.2	Secure development life cycle	Crosswalk	Same topic: Secure Development 4 loosely related (not mappings) 3.1 Incident handling policy Loosely related Only shares CSF RS.MI-02: related, not a mapping 3.5 Incident response Loosely related Only shares CSF RS.MI-02: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.SC-09: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping
Essential Eight	ISM-1515 ISM-1807	Restoration of data, applications and settings from backups to a common point in time…; An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF RC.RP-05, ID.AM-08: related, not a mapping
DORA	Art.28(2)Art.29(1)Art.29(2)Art.8(1)	General principles; Preliminary assessment of ICT concentration risk at entity level…	Loosely related	No mapping. Only shares CSF GV.SC-03, GV.SC-09, ID.AM-08: related, not a mapping +8 more loosely related (not mappings) Art.8(4) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.11(2)(c) Response and recovery Loosely related Only shares CSF RS.MI-02: related, not a mapping Art.11(2)(e) Response and recovery Loosely related Only shares CSF RC.RP-05: related, not a mapping …and 4 more in the downloads
CPS 234	Para 16 Para 22 Para 20	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Loosely related	No mapping. Only shares CSF GV.SC-03, GV.SC-09, ID.AM-08: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.