PCI DSS · Requirement 6: Develop and maintain secure systems and software

Payment page scripts authorised and integrity-checked

frameworkPCI DSS v4.0.1 sectionRequirement 6: Develop and maintain secure systems and software csf 2.0DE.AE-07 DE.CM-09 GV.SC-01 GV.SC-03 GV.SC-07 GV.SC-09 GV.SC-10 ID.AM-02 ID.RA-09 PR.IR-01 PR.PS-05 PR.PS-06 topicsWeb Security frameworks0 6 0

Official text · not licensableSummary (ControlMapping's wording): Payment page scripts authorised and integrity-checked. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 6.4.3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.IR-01 PR.PS-06	Networks and environments are protected from unauthorized logical access and usage; Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle	Editorial	Same topic: Web Security (editorial pick) 10 loosely related (not mappings) DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis Loosely related Only shares CSF DE.AE-07: related, not a mapping DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-09: related, not a mapping GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders Loosely related Only shares CSF GV.SC-01: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Loosely related Only shares CSF GV.SC-07: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained Loosely related Only shares CSF ID.AM-02: related, not a mapping …and 2 more in the downloads
ISO 27001	A.8.26	Application security requirements	Editorial	Same topic: Web Security (editorial pick) 25 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-01, GV.SC-07, GV.SC-09, GV.SC-10…: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-07, GV.SC-10: related, not a mapping …and 17 more in the downloads
CIS v8.1	CIS 9.3 CIS 13.10 CIS 16.10	Maintain and Enforce Network-Based URL Filters; Perform Application Layer Filtering…	Editorial	Same topic: Web Security (editorial pick) 52 loosely related (not mappings) CIS 15.6 Monitor Service Providers Loosely related Only shares CSF GV.SC-07, GV.SC-09: related, not a mapping CIS 15.7 Securely Decommission Service Providers Loosely related Only shares CSF GV.SC-07, GV.SC-10: related, not a mapping CIS 2.1 Establish and Maintain a Software Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping CIS 2.5 Allowlist Authorized Software Loosely related Only shares CSF PR.PS-05: related, not a mapping CIS 10.1 Deploy and Maintain Anti-Malware Software Loosely related Only shares CSF DE.CM-09: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF GV.SC-01: related, not a mapping CIS 2.6 Allowlist Authorized Libraries Loosely related Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping CIS 2.7 Allowlist Authorized Scripts Loosely related Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping …and 44 more in the downloads
SOC 2	CC6.6	Protection against threats from outside system boundaries	Editorial	Same topic: Web Security (editorial pick) 5 loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-02: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.CM-09: related, not a mapping CC8.1 Change management for infrastructure, data and software Loosely related Only shares CSF PR.PS-06: related, not a mapping
CMMC	SC.L2-3.13.1	Boundary Protection	Editorial	Same topic: Web Security (editorial pick) 22 loosely related (not mappings) RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF DE.AE-07, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF DE.CM-09, PR.IR-01: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF DE.CM-09, PR.IR-01: related, not a mapping AC.L2-3.1.20 External Connections Loosely related Only shares CSF ID.AM-02: related, not a mapping AC.L2-3.1.21 Portable Storage Use Loosely related Only shares CSF ID.AM-02: related, not a mapping AU.L2-3.3.3 Event Review Loosely related Only shares CSF DE.CM-09: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.CM-09: related, not a mapping CM.L2-3.4.2 Security Configuration Enforcement Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 14 more in the downloads
800-53	SC-7 SI-10	Boundary Protection; Information Input Validation	Editorial	Same topic: Web Security (editorial pick) 53 loosely related (not mappings) SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF DE.AE-07, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10, ID.RA-09: related, not a mapping SA-9 External System Services Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10, ID.AM-02: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10, ID.RA-09: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping …and 45 more in the downloads
HIPAA	§164.308(b)(4)§164.314(a)§164.314(a)(2)(i)§164.314(a)(2)(iii)	Written Contract or Other Arrangement; Business Associate Contracts or Other Arrangements…	Loosely related	No mapping. Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10, ID.AM-02…: related, not a mapping +36 more loosely related (not mappings) §164.308(a)(1)(ii)(A) Risk Analysis Loosely related Only shares CSF DE.AE-07, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF DE.AE-07, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10, ID.AM-02: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10, ID.AM-02: related, not a mapping …and 32 more in the downloads
GDPR	Art.28(1)Art.25(1)Art.28(3)Art.30(1)	Processor; Data protection by design and by default…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping
NIS2	5.1 6.7 6.9 4.3	Supply chain security policy; Network security…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-07, GV.SC-09, GV.SC-10…: related, not a mapping +5 more loosely related (not mappings) 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF ID.RA-09: related, not a mapping 6.6 Security patch management Loosely related Only shares CSF DE.CM-09: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping 6.2 Secure development life cycle Loosely related Only shares CSF PR.PS-06: related, not a mapping …and 1 more in the downloads
Essential Eight	ISM-0843 ISM-1488 ISM-1490 ISM-1544	Application control is implemented on workstations; Microsoft Office macros in files originating from the internet are blocked…	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping +23 more loosely related (not mappings) ISM-1657 Application control restricts the execution of executables, libraries, scripts… Loosely related Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping ISM-1870 Application control is applied to user profiles and temporary folders used by operating… Loosely related Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security… Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 19 more in the downloads
DORA	Art.28(2)Art.29(1)Art.29(2)Art.28(8)	General principles; Preliminary assessment of ICT concentration risk at entity level…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09, ID.RA-09…: related, not a mapping +15 more loosely related (not mappings) Art.30(2) Key contractual provisions Loosely related Only shares CSF GV.SC-07, PR.IR-01: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF ID.AM-02: related, not a mapping Art.8(2) Identification Loosely related Only shares CSF DE.AE-07: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-02: related, not a mapping …and 11 more in the downloads
CPS 234	Para 16 Para 22 Para 17 Para 20	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Loosely related	No mapping. Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping +2 more loosely related (not mappings) Para 28 Check third parties' control testing is adequate Loosely related Only shares CSF GV.SC-07: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.SC-07: related, not a mapping
Cyber Essentials	CE 5 CE 1 CE 3 CE 4	Malware protection; Firewalls…	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.PS-05, PR.IR-01, ID.AM-02: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.