PCI DSS · Requirement 7: Restrict access to system components and cardholder data by business need to know

System and application account access periodically reviewed

frameworkPCI DSS v4.0.1 sectionRequirement 7: Restrict access to system components and cardholder data by business need to know csf 2.0GV.OV-03 GV.RM-03 GV.RM-06 PR.AA-05 topics— frameworks0 0 0

Official text · not licensableSummary (ControlMapping's wording): System and application account access periodically reviewed. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.

gap from PCI DSS → gap to PCI DSS →

Wrong or missing mapping? Report it

Equivalents of 7.2.5.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OV-03 GV.RM-03 GV.RM-06 PR.AA-05	Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed; Cybersecurity risk management activities and outcomes are included in enterprise risk management processes…	Loosely related	No mapping. Only shares CSF GV.OV-03, GV.RM-03, GV.RM-06, PR.AA-05: related, not a mapping
ISO 27001	A.5.1 A.5.3 A.5.14 A.5.15	Policies for information security; Segregation of duties…	Loosely related	No mapping. Only shares CSF GV.OV-03, GV.RM-03, GV.RM-06, PR.AA-05: related, not a mapping +18 more loosely related (not mappings) A.5.16 Identity management Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.17 Authentication information Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.18 Access rights Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-03: related, not a mapping …and 14 more in the downloads
CIS v8.1	CIS 3.3 CIS 5.1 CIS 6.8 CIS 4.10	Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +13 more loosely related (not mappings) CIS 4.11 Enforce Remote Wipe Capability on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.12 Separate Enterprise Workspaces on Mobile End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.2 Use Unique Passwords Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.3 Disable Dormant Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 9 more in the downloads
SOC 2	CC3.1 CC5.1 CC9.1 CC4.1	Objectives specified clearly enough to identify risks; Control activities that mitigate risks…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, GV.OV-03: related, not a mapping +6 more loosely related (not mappings) CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OV-03: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.2 User registration, authorization and removal Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.3 Role-based access, least privilege and segregation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 2 more in the downloads
CMMC	RA.L2-3.11.1 AC.L2-3.1.1 AC.L2-3.1.2 AC.L2-3.1.4	Risk Assessments; Authorized Access Control…	Loosely related	No mapping. Only shares CSF GV.OV-03, GV.RM-06, PR.AA-05: related, not a mapping +18 more loosely related (not mappings) AC.L2-3.1.5 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.6 Non-Privileged Account Use Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.7 Privileged Functions Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.12 Control Remote Access Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 14 more in the downloads
800-53	PM-9 PM-30 RA-7 AC-2	Risk Management Strategy; Supply Chain Risk Management Strategy…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, GV.OV-03, PR.AA-05: related, not a mapping +23 more loosely related (not mappings) AC-3 Access Enforcement Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-5 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-6 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-10 Concurrent Session Control Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 19 more in the downloads
HIPAA	§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(A)§164.308(a)(3)§164.308(a)(3)(ii)(A)	Risk Management; Risk Analysis…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, PR.AA-05: related, not a mapping +15 more loosely related (not mappings) §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 11 more in the downloads
GDPR	Art.24(1)Art.32(2)Art.5(2)Art.25(2)	Responsibility of the controller; Security of processing…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, GV.OV-03, PR.AA-05: related, not a mapping +1 more loosely related (not mappings) Art.32(1)(b) Security of processing Loosely related Only shares CSF PR.AA-05: related, not a mapping
NIS2	2.1 1.1 7.1 11.1	Risk management framework; Policy on the security of network and information systems…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, PR.AA-05: related, not a mapping +5 more loosely related (not mappings) 11.2 Management of access rights Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.5 Identification Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.6 Authentication Loosely related Only shares CSF PR.AA-05: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OV-03: related, not a mapping …and 1 more in the downloads
Essential Eight	ISM-0445 ISM-1175 ISM-1380 ISM-1387	Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online……	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +16 more loosely related (not mappings) ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1647 Privileged access to systems and their resources are disabled after 12 months unless… Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 12 more in the downloads
DORA	Art.5(2)(a)Art.6(1)Art.6(8)Art.16(1)	Governance and organisation; ICT risk management framework…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping +5 more loosely related (not mappings) Art.24(1) General requirements for the performance of digital operational resilience testing Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OV-03: related, not a mapping …and 1 more in the downloads
CPS 234	Para 13 Para 15 Para 27 Para 31	Board ultimately responsible for information security; Maintain a capability commensurate with threats…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping +3 more loosely related (not mappings) Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OV-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OV-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OV-03: related, not a mapping
Cyber Essentials	CE 2 CE 4	Secure Configuration; User Access Control	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.