PCI DSS · Requirement 6: Develop and maintain secure systems and software
6.3.2
Inventory of custom software and its components
frameworkPCI DSS v4.0.1
sectionRequirement 6: Develop and maintain secure systems and software
csf 2.0GV.SC-01 GV.SC-03 GV.SC-04 GV.SC-07 GV.SC-09 ID.AM-02 ID.RA-01 PR.PS-02 PR.PS-06
topicsSupply Chain Risk, Asset Management
frameworks7 6 0
Official text · not licensableSummary (ControlMapping's wording): Inventory of custom software and its components. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.SC-01GV.SC-03GV.SC-05GV.SC-09ID.AM-01ID.AM-02ID.AM-04ID.AM-08ID.RA-09 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders; Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes… | Crosswalk | Same topic: Supply Chain Risk, Asset Management5 loosely related (not mappings)GV.SC-04 Suppliers are known and prioritized by criticality Only shares CSF GV.SC-04: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Only shares CSF GV.SC-07: related, not a mapping ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded Only shares CSF ID.RA-01: related, not a mapping PR.PS-02 Software is maintained, replaced, and removed commensurate with risk Only shares CSF PR.PS-02: related, not a mapping PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle Only shares CSF PR.PS-06: related, not a mapping |
| ISO 27001 | A.5.9A.5.11A.5.19A.5.21A.7.14 | Inventory of information and other associated assets; Return of assets… | Crosswalk | Same topic: Asset Management, Supply Chain Risk15 loosely related (not mappings)A.5.20 Addressing information security within supplier agreements Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Only shares CSF GV.SC-01, GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 8.1 Operational planning and control Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.SC-07: related, not a mapping …and 7 more in the downloads |
| CIS v8.1 | CIS 1.1CIS 2.1CIS 15.2CIS 1.2CIS 1.3CIS 1.4CIS 1.5CIS 2.3CIS 2.4CIS 16.4 | Establish and Maintain Detailed Enterprise Asset Inventory; Establish and Maintain a Software Inventory… | Crosswalk | Same topic: Asset Management, Supply Chain Risk32 loosely related (not mappings)CIS 2.2 Ensure Authorized Software is Currently Supported Only shares CSF PR.PS-02: related, not a mapping CIS 7.1 Establish and Maintain a Vulnerability Management Process Only shares CSF ID.RA-01: related, not a mapping CIS 15.1 Establish and Maintain an Inventory of Service Providers Only shares CSF GV.SC-04: related, not a mapping CIS 16.1 Establish and Maintain a Secure Application Development Process Only shares CSF PR.PS-06: related, not a mapping CIS 15.4 Ensure Service Provider Contracts Include Security Requirements Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping CIS 15.7 Securely Decommission Service Providers Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping …and 24 more in the downloads |
| SOC 2 | CC6.1CC9.2 | Logical access security over information assets; Managing vendor and business partner risk | Editorial | Same topic: Asset Management, Supply Chain Risk (editorial pick)3 loosely related (not mappings)CC7.1 Detecting configuration changes and new vulnerabilities Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping CC6.6 Protection against threats from outside system boundaries Only shares CSF PR.PS-06: related, not a mapping CC8.1 Change management for infrastructure, data and software Only shares CSF PR.PS-06: related, not a mapping |
| CMMC | CM.L2-3.4.1 | System Baselining | Crosswalk | Same topic: Asset Management16 loosely related (not mappings)RA.L2-3.11.1 Risk Assessments Only shares CSF GV.SC-03, GV.SC-04, GV.SC-07, GV.SC-09…: related, not a mapping …and 8 more in the downloads |
| 800-53 | CM-8PM-5PM-30SR-2SR-3SR-11 | System Component Inventory; System Inventory… | Crosswalk | Same topic: Asset Management, Supply Chain Risk |
| HIPAA | §164.310(d)§164.310(d)(2)(iii) | Device and Media Controls; Accountability | Crosswalk | Same topic: Asset Management35 loosely related (not mappings)§164.308(b)(1) Business Associate Contracts and Other Arrangements Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, ID.AM-02: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, ID.AM-02: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, ID.AM-02: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, ID.AM-02: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, ID.AM-02: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, ID.AM-02: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, ID.AM-02: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Only shares CSF GV.SC-03, GV.SC-09, ID.RA-01: related, not a mapping …and 27 more in the downloads |
| GDPR | Art.28(1)Art.30(1) | Processor; Records of processing activities | Editorial | Same topic: Supply Chain Risk, Asset Management (editorial pick)3 loosely related (not mappings) |
| NIS2 | 5.16.112.4 | Supply chain security policy; Security in acquisition of ICT services, ICT systems or ICT products… | Crosswalk | Same topic: Supply Chain Risk, Asset Management6 loosely related (not mappings)6.10 Vulnerability handling and disclosure Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | Editorial | Same topic: Asset Management (editorial pick)28 loosely related (not mappings)ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping …and 20 more in the downloads |
| DORA | Art.8(1)Art.8(4)Art.8(6)Art.28(2)Art.29(1)Art.29(2) | Identification; Identification… | Editorial | Same topic: Asset Management, Supply Chain Risk (editorial pick)11 loosely related (not mappings)…and 3 more in the downloads |
| CPS 234 | Para 16Para 20Para 22 | Assess third parties' information security capability; Classify information assets by criticality and sensitivity… | Editorial | Same topic: Supply Chain Risk, Asset Management (editorial pick)5 loosely related (not mappings)Para 28 Check third parties' control testing is adequate Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Para 17 Keep capability current as threats and vulnerabilities change Only shares CSF ID.RA-01: related, not a mapping Para 27 Systematic testing programme for control effectiveness Only shares CSF ID.RA-01: related, not a mapping Para 30 Testing by skilled, functionally independent specialists Only shares CSF ID.RA-01: related, not a mapping |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Asset Management (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.