ISO 27001:2022 to PCI DSS 4.0 crosswalk

29 control objectives in ISO/IEC 27001 (Annex A controls and management clauses) are mapped here to PCI DSS. 1 of them has no direct PCI DSS 4.0 requirement, which is marked in the table. Each row is one shared objective, with the requirement ids on both sides.

Control objective	ISO 27001:2022	PCI DSS 4.0
Security governance and policies	`A.5.1`Policies for information security `A.5.36`Compliance with policies, rules and standards for information security	`12.1`A comprehensive information security policy is established, published, maintained and disseminated `12.4`PCI DSS compliance is managed
Security roles and accountability	`A.5.2`Information security roles and responsibilities `A.5.3`Segregation of duties	`12.1.3`Security policy defines information security roles and responsibilities `12.4.1`Executive management responsibility for protection of cardholder data (service providers)
Risk assessment and treatment	`Clause 6.1.2`Information security risk assessment `Clause 6.1.3`Information security risk treatment	`12.3`Risks to the cardholder data environment are formally identified, evaluated and managed `12.3.1`Targeted risk analysis for requirements with flexible frequency
Asset and system inventory	`A.5.9`Inventory of information and other associated assets	`12.5.1`Inventory of system components in scope for PCI DSS is maintained `12.5.2`PCI DSS scope is documented and confirmed at least every 12 months
Data classification and handling	`A.5.12`Classification of information `A.5.13`Labelling of information	`12.5.2`PCI DSS scope is documented and confirmed (includes identifying all data flows)
Access provisioning, review and removal	`A.5.15`Access control `A.5.16`Identity management `A.5.18`Access rights	`7.2`Access to system components and data is appropriately defined and assigned (incl. 7.2.4 six-month review) `7.3`Access is managed via an access control system `8.2.5`Access for terminated users is immediately revoked
Least privilege and privileged access	`A.8.2`Privileged access rights `A.8.3`Information access restriction	`7.2.1`An access control model is defined `7.2.2`Access assigned based on job classification and least privileges
Authentication, unique IDs and multi-factor authentication	`A.5.17`Authentication information `A.8.5`Secure authentication	`8.2`User identification and related accounts are strictly managed `8.3`Strong authentication for users and administrators is established and managed `8.4`Multi-factor authentication is implemented `8.5`MFA systems are configured to prevent misuse
Encryption at rest and key management	`A.8.24`Use of cryptography	`3.5`Primary account number is secured wherever it is stored `3.6`Cryptographic keys used to protect stored account data are secured `3.7`Key management processes and procedures are defined and implemented
Encryption in transit	`A.5.14`Information transfer `A.8.24`Use of cryptography	`4.2`PAN is protected with strong cryptography during transmission `2.2.7`All non-console administrative access is encrypted
Network security and segmentation	`A.8.20`Networks security `A.8.21`Security of network services `A.8.22`Segregation of networks	`1.2`Network security controls are configured and maintained `1.3`Network access to and from the cardholder data environment is restricted `1.4`Network connections between trusted and untrusted networks are controlled
Secure configuration and hardening	`A.8.9`Configuration management	`2.2`System components are configured and managed securely
Vulnerability scanning and patching	`A.8.8`Management of technical vulnerabilities	`6.3`Security vulnerabilities are identified and addressed `11.3`External and internal vulnerabilities are regularly identified, prioritized and addressed
Penetration testing and independent assessment	`A.8.29`Security testing in development and acceptance `A.5.35`Independent review of information security	`11.4`External and internal penetration testing is regularly performed
Logging, log review and monitoring	`A.8.15`Logging `A.8.16`Monitoring activities `A.8.17`Clock synchronization	`10.2`Audit logs are implemented to support detection of anomalies and suspicious activity `10.3`Audit logs are protected from destruction and unauthorized modification `10.4`Audit logs are reviewed to identify anomalies or suspicious activity `10.5`Audit log history is retained and available for analysis `10.6`Time-synchronization mechanisms support consistent time settings
Intrusion detection and integrity monitoring	`A.8.16`Monitoring activities	`11.5`Network intrusions and unexpected file changes are detected and responded to `11.6`Unauthorized changes on payment pages are detected and responded to
Malware protection	`A.8.7`Protection against malware	`5.2`Malicious software is prevented, or detected and addressed `5.3`Anti-malware mechanisms and processes are active, maintained and monitored `5.4`Anti-phishing mechanisms protect users against phishing attacks
Incident response and breach notification	`A.5.24`Information security incident management planning and preparation `A.5.25`Assessment and decision on information security events `A.5.26`Response to information security incidents `A.5.27`Learning from information security incidents	`12.10`Suspected and confirmed security incidents that could impact the CDE are responded to immediately (12.10.1 IR plan, 12.10.2 annual review and test)
Change management	`A.8.32`Change management	`6.5`Changes to all system components are managed securely (6.5.1 change control procedures)
Secure software development	`A.8.25`Secure development life cycle `A.8.26`Application security requirements `A.8.28`Secure coding `A.8.29`Security testing in development and acceptance `A.8.31`Separation of development, test and production environments	`6.2`Bespoke and custom software is developed securely `6.4`Public-facing web applications are protected against attacks
Third-party and vendor risk management	`A.5.19`Information security in supplier relationships `A.5.20`Addressing information security within supplier agreements `A.5.21`Managing information security in the ICT supply chain `A.5.22`Monitoring, review and change management of supplier services `A.5.23`Information security for use of cloud services	`12.8`Risk to information assets associated with third-party service provider relationships is managed `12.9`Third-party service providers support their customers' PCI DSS compliance
Business continuity and disaster recovery	`A.5.29`Information security during disruption `A.5.30`ICT readiness for business continuity	`12.10.1`Incident response plan includes business recovery and continuity procedures
Backup and redundancy	`A.8.13`Information backup `A.8.14`Redundancy of information processing facilities	`12.10.1`Incident response plan includes data backup processes `9.4.1.1`Offline media backups with cardholder data are stored in a secure location
Capacity and availability management	`A.8.6`Capacity management	no direct requirement
Security awareness and training	`A.6.3`Information security awareness, education and training	`12.6`Security awareness education is an ongoing activity (12.6.1 program, 12.6.2 annual review, 12.6.3 training at hire and annually)
Personnel screening, terms and sanctions	`A.6.1`Screening `A.6.2`Terms and conditions of employment `A.6.4`Disciplinary process `A.6.5`Responsibilities after termination or change of employment	`12.7`Personnel are screened to reduce risks from insider threats
Physical access and facility security	`A.7.1`Physical security perimeters `A.7.2`Physical entry `A.7.4`Physical security monitoring	`9.2`Physical access controls manage entry into facilities and systems containing cardholder data `9.3`Physical access for personnel and visitors is authorized and managed
Data retention, media handling and secure disposal	`A.7.10`Storage media `A.7.14`Secure disposal or re-use of equipment `A.8.10`Information deletion	`3.2`Storage of account data is kept to a minimum (3.2.1 retention and disposal) `9.4`Media with cardholder data is securely stored, accessed, distributed and destroyed
Ongoing control monitoring and internal audit	`Clause 9.2`Internal audit `Clause 9.3`Management review	`12.4.2`Reviews confirm personnel perform tasks per policy (service providers)

Open a control objective for the evidence checklist.PCI DSS 4.0 to ISO 27001:2022 →

Scope: Annex A controls are prefixed 'A.'; management-system clauses are prefixed 'Clause'. Mapped at requirement / sub-requirement level. Many PCI requirements only apply to the cardholder data environment (CDE) or to service providers. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from ISO 27001:2022

ISO 27001:2022 to SOC 2 ISO 27001:2022 to NIST CSF 2.0 ISO 27001:2022 to HIPAA Security Rule ISO 27001:2022 to NIST 800-53 r5