PCI DSS · Requirement 6: Develop and maintain secure systems and software
6.3.1
Vulnerabilities identified and risk-ranked
frameworkPCI DSS v4.0.1
sectionRequirement 6: Develop and maintain secure systems and software
csf 2.0DE.AE-02 DE.AE-07 GV.RM-03 GV.RM-06 GV.SC-01 GV.SC-03 GV.SC-07 GV.SC-09 ID.AM-05 ID.AM-08 ID.RA-01 ID.RA-05 PR.PS-02 RS.AN-03
topicsVulnerability Mgmt, Threat Intelligence, Patch Management
frameworks7 6 0
Official text · not licensableSummary (ControlMapping's wording): Vulnerabilities identified and risk-ranked. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.AE-07ID.RA-01ID.RA-02ID.RA-03ID.RA-08PR.PS-02 | Cyber threat intelligence and other contextual information are integrated into the analysis; Vulnerabilities in assets are identified, validated, and recorded… | Crosswalk | Same topic: Threat Intelligence, Vulnerability Mgmt, Patch Management11 loosely related (not mappings)DE.AE-02 Potentially adverse events are analyzed to better understand associated activities Only shares CSF DE.AE-02: related, not a mapping GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes Only shares CSF GV.RM-03: related, not a mapping GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated Only shares CSF GV.RM-06: related, not a mapping GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders Only shares CSF GV.SC-01: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Only shares CSF GV.SC-03: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Only shares CSF GV.SC-07: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Only shares CSF GV.SC-09: related, not a mapping ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission Only shares CSF ID.AM-05: related, not a mapping …and 3 more in the downloads |
| ISO 27001 | A.5.7A.8.8 | Threat intelligence; Management of technical vulnerabilities | Crosswalk | Same topic: Threat Intelligence, Vulnerability Mgmt, Patch Management22 loosely related (not mappings)A.5.19 Information security in supplier relationships Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping A.5.1 Policies for information security Only shares CSF GV.RM-03, GV.RM-06, GV.SC-01, GV.SC-03: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Only shares CSF GV.SC-01, GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.RM-06, GV.SC-07, GV.SC-09, ID.RA-05: related, not a mapping A.5.9 Inventory of information and other associated assets Only shares CSF ID.AM-05, ID.AM-08, PR.PS-02: related, not a mapping A.5.21 Managing information security in the ICT supply chain Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping …and 14 more in the downloads |
| CIS v8.1 | CIS 2.2CIS 7.1CIS 7.2CIS 7.3CIS 7.4CIS 7.5CIS 7.6CIS 7.7CIS 12.1CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Ensure Authorized Software is Currently Supported; Establish and Maintain a Vulnerability Management Process… | Crosswalk | Same topic: Patch Management, Vulnerability Mgmt21 loosely related (not mappings)CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping CIS 3.7 Establish and Maintain a Data Classification Scheme Only shares CSF ID.AM-05: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Only shares CSF GV.SC-01: related, not a mapping …and 13 more in the downloads |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Vulnerability Mgmt, Patch Management (editorial pick)11 loosely related (not mappings)CC9.2 Managing vendor and business partner risk Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping CC5.1 Control activities that mitigate risks Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping CC9.1 Mitigating risks from business disruptions Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping C1.1 Identifying and protecting confidential information Only shares CSF ID.AM-05: related, not a mapping CC3.4 Identifying and assessing significant changes Only shares CSF ID.RA-05: related, not a mapping …and 3 more in the downloads |
| CMMC | RA.L2-3.11.2RA.L2-3.11.3SI.L2-3.14.1SI.L2-3.14.3 | Vulnerability Scan; Vulnerability Remediation… | Crosswalk | Same topic: Vulnerability Mgmt, Patch Management, Threat Intelligence16 loosely related (not mappings)RA.L2-3.11.1 Risk Assessments Only shares CSF DE.AE-07, GV.RM-06, GV.SC-03, GV.SC-07…: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Only shares CSF DE.AE-02, ID.RA-01: related, not a mapping …and 8 more in the downloads |
| 800-53 | CA-8PM-15PM-16RA-5SI-2SI-5 | Penetration Testing; Security and Privacy Groups and Associations… | Crosswalk | Same topic: Vulnerability Mgmt, Threat Intelligence, Patch Management45 loosely related (not mappings)RA-3 Risk Assessment Only shares CSF DE.AE-07, GV.RM-06, GV.SC-03, GV.SC-09…: related, not a mapping PM-30 Supply Chain Risk Management Strategy Only shares CSF GV.RM-03, GV.RM-06, GV.SC-01, GV.SC-03…: related, not a mapping PM-9 Risk Management Strategy Only shares CSF GV.RM-03, GV.RM-06, GV.SC-03, GV.SC-09: related, not a mapping SR-2 Supply Chain Risk Management Plan Only shares CSF GV.RM-03, GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping SR-3 Supply Chain Controls and Processes Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09: related, not a mapping …and 37 more in the downloads |
| HIPAA | §164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B) | Evaluation; Risk Analysis… | Crosswalk | Same topic: Vulnerability Mgmt40 loosely related (not mappings)§164.316(a) Policies and Procedures Only shares CSF DE.AE-07, GV.RM-06, GV.SC-03, GV.SC-09…: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF DE.AE-02, ID.RA-01, RS.AN-03: related, not a mapping §164.308(a)(6) Security Incident Procedures Only shares CSF DE.AE-02, GV.SC-03, RS.AN-03: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Only shares CSF GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping …and 32 more in the downloads |
| GDPR | Art.32(1)(d) | Security of processing | Editorial | Same topic: Vulnerability Mgmt (editorial pick)7 loosely related (not mappings)Art.24(1) Responsibility of the controller Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping |
| NIS2 | 6.56.66.10 | Security testing; Security patch management… | Crosswalk | Same topic: Vulnerability Mgmt, Patch Management9 loosely related (not mappings)2.1 Risk management framework Only shares CSF GV.RM-03, GV.RM-06, ID.RA-01, ID.RA-05: related, not a mapping 5.1 Supply chain security policy Only shares CSF GV.SC-01, GV.SC-07, GV.SC-09: related, not a mapping 1.1 Policy on the security of network and information systems Only shares CSF GV.RM-03: related, not a mapping 7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures Only shares CSF GV.RM-06: related, not a mapping …and 1 more in the downloads |
| Essential Eight | ISM-1501ISM-1691ISM-1693ISM-1695ISM-1698ISM-1699ISM-1701ISM-1702ISM-1704ISM-1807ISM-1808ISM-1876ISM-1877 | Operating systems that are no longer supported by vendors are replaced; Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release… | Editorial | Same topic: Patch Management, Vulnerability Mgmt (editorial pick)20 loosely related (not mappings)ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1696 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1697 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1700 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping …and 12 more in the downloads |
| DORA | Art.8(2)Art.9(4)(f)Art.13(1)Art.25(1)Art.26(1)Art.27(1)Art.45(1) | Identification; Protection and prevention… | Editorial | Same topic: Vulnerability Mgmt, Threat Intelligence, Patch Management (editorial pick)23 loosely related (not mappings)Art.29(1) Preliminary assessment of ICT concentration risk at entity level Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping Art.16(1) Simplified ICT risk management framework Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping …and 15 more in the downloads |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness… | Editorial | Same topic: Vulnerability Mgmt, Threat Intelligence (editorial pick)10 loosely related (not mappings)Para 16 Assess third parties' information security capability Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09: related, not a mapping Para 22 Evaluate the design of third parties' controls Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09: related, not a mapping Para 13 Board ultimately responsible for information security Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 15 Maintain a capability commensurate with threats Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 20 Classify information assets by criticality and sensitivity Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping Para 31 Review the testing programme at least annually Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 21 Timely controls commensurate with risk and asset life-cycle Only shares CSF ID.RA-05: related, not a mapping Para 23 Detect and respond to incidents in a timely manner Only shares CSF DE.AE-02: related, not a mapping …and 2 more in the downloads |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Vulnerability Mgmt, Patch Management (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.