PCI DSS 4.0 to NIST 800-53 r5 crosswalk

28 control objectives in PCI DSS are mapped here to NIST SP 800-53 Security and Privacy Controls. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	PCI DSS 4.0	NIST 800-53 r5
Security governance and policies	`12.1`A comprehensive information security policy is established, published, maintained and disseminated `12.4`PCI DSS compliance is managed	`PM-1`Information security program plan `PL-1`Policy and procedures (planning)
Security roles and accountability	`12.1.3`Security policy defines information security roles and responsibilities `12.4.1`Executive management responsibility for protection of cardholder data (service providers)	`PM-2`Information security program leadership role `AC-5`Separation of duties
Risk assessment and treatment	`12.3`Risks to the cardholder data environment are formally identified, evaluated and managed `12.3.1`Targeted risk analysis for requirements with flexible frequency	`RA-3`Risk assessment `PM-9`Risk management strategy
Asset and system inventory	`12.5.1`Inventory of system components in scope for PCI DSS is maintained `12.5.2`PCI DSS scope is documented and confirmed at least every 12 months	`CM-8`System component inventory
Data classification and handling	`12.5.2`PCI DSS scope is documented and confirmed (includes identifying all data flows)	`RA-2`Security categorization
Access provisioning, review and removal	`7.2`Access to system components and data is appropriately defined and assigned (incl. 7.2.4 six-month review) `7.3`Access is managed via an access control system `8.2.5`Access for terminated users is immediately revoked	`AC-2`Account management `AC-3`Access enforcement `PS-4`Personnel termination `PS-5`Personnel transfer
Least privilege and privileged access	`7.2.1`An access control model is defined `7.2.2`Access assigned based on job classification and least privileges	`AC-6`Least privilege `AC-5`Separation of duties
Authentication, unique IDs and multi-factor authentication	`8.2`User identification and related accounts are strictly managed `8.3`Strong authentication for users and administrators is established and managed `8.4`Multi-factor authentication is implemented `8.5`MFA systems are configured to prevent misuse	`IA-2`Identification and authentication (organizational users) `IA-5`Authenticator management
Encryption at rest and key management	`3.5`Primary account number is secured wherever it is stored `3.6`Cryptographic keys used to protect stored account data are secured `3.7`Key management processes and procedures are defined and implemented	`SC-28`Protection of information at rest `SC-12`Cryptographic key establishment and management `SC-13`Cryptographic protection
Encryption in transit	`4.2`PAN is protected with strong cryptography during transmission `2.2.7`All non-console administrative access is encrypted	`SC-8`Transmission confidentiality and integrity `SC-13`Cryptographic protection
Network security and segmentation	`1.2`Network security controls are configured and maintained `1.3`Network access to and from the cardholder data environment is restricted `1.4`Network connections between trusted and untrusted networks are controlled	`SC-7`Boundary protection `AC-4`Information flow enforcement
Secure configuration and hardening	`2.2`System components are configured and managed securely	`CM-2`Baseline configuration `CM-6`Configuration settings `CM-7`Least functionality
Vulnerability scanning and patching	`6.3`Security vulnerabilities are identified and addressed `11.3`External and internal vulnerabilities are regularly identified, prioritized and addressed	`RA-5`Vulnerability monitoring and scanning `SI-2`Flaw remediation
Penetration testing and independent assessment	`11.4`External and internal penetration testing is regularly performed	`CA-8`Penetration testing `CA-2`Control assessments
Logging, log review and monitoring	`10.2`Audit logs are implemented to support detection of anomalies and suspicious activity `10.3`Audit logs are protected from destruction and unauthorized modification `10.4`Audit logs are reviewed to identify anomalies or suspicious activity `10.5`Audit log history is retained and available for analysis `10.6`Time-synchronization mechanisms support consistent time settings	`AU-2`Event logging `AU-6`Audit record review, analysis and reporting `AU-11`Audit record retention `SI-4`System monitoring
Intrusion detection and integrity monitoring	`11.5`Network intrusions and unexpected file changes are detected and responded to `11.6`Unauthorized changes on payment pages are detected and responded to	`SI-4`System monitoring `SI-7`Software, firmware and information integrity
Malware protection	`5.2`Malicious software is prevented, or detected and addressed `5.3`Anti-malware mechanisms and processes are active, maintained and monitored `5.4`Anti-phishing mechanisms protect users against phishing attacks	`SI-3`Malicious code protection
Incident response and breach notification	`12.10`Suspected and confirmed security incidents that could impact the CDE are responded to immediately (12.10.1 IR plan, 12.10.2 annual review and test)	`IR-4`Incident handling `IR-8`Incident response plan `IR-6`Incident reporting `IR-3`Incident response testing
Change management	`6.5`Changes to all system components are managed securely (6.5.1 change control procedures)	`CM-3`Configuration change control `CM-4`Impact analyses `CM-5`Access restrictions for change
Secure software development	`6.2`Bespoke and custom software is developed securely `6.4`Public-facing web applications are protected against attacks	`SA-3`System development life cycle `SA-8`Security and privacy engineering principles `SA-11`Developer testing and evaluation
Third-party and vendor risk management	`12.8`Risk to information assets associated with third-party service provider relationships is managed `12.9`Third-party service providers support their customers' PCI DSS compliance	`SR-3`Supply chain controls and processes `SR-6`Supplier assessments and reviews `SA-9`External system services
Business continuity and disaster recovery	`12.10.1`Incident response plan includes business recovery and continuity procedures	`CP-2`Contingency plan `CP-4`Contingency plan testing `CP-10`System recovery and reconstitution
Backup and redundancy	`12.10.1`Incident response plan includes data backup processes `9.4.1.1`Offline media backups with cardholder data are stored in a secure location	`CP-9`System backup
Security awareness and training	`12.6`Security awareness education is an ongoing activity (12.6.1 program, 12.6.2 annual review, 12.6.3 training at hire and annually)	`AT-2`Literacy training and awareness `AT-3`Role-based training
Personnel screening, terms and sanctions	`12.7`Personnel are screened to reduce risks from insider threats	`PS-3`Personnel screening `PS-4`Personnel termination `PS-8`Personnel sanctions
Physical access and facility security	`9.2`Physical access controls manage entry into facilities and systems containing cardholder data `9.3`Physical access for personnel and visitors is authorized and managed	`PE-2`Physical access authorizations `PE-3`Physical access control `PE-6`Monitoring physical access
Data retention, media handling and secure disposal	`3.2`Storage of account data is kept to a minimum (3.2.1 retention and disposal) `9.4`Media with cardholder data is securely stored, accessed, distributed and destroyed	`MP-6`Media sanitization `SI-12`Information management and retention
Ongoing control monitoring and internal audit	`12.4.2`Reviews confirm personnel perform tasks per policy (service providers)	`CA-2`Control assessments `CA-7`Continuous monitoring

Open a control objective for the evidence checklist.NIST 800-53 r5 to PCI DSS 4.0 →

Scope: Mapped at requirement / sub-requirement level. Many PCI requirements only apply to the cardholder data environment (CDE) or to service providers. Base controls only (no enhancements). FedRAMP, TX-RAMP and StateRAMP baselines are built on 800-53, but baseline membership and parameters are not included here. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from PCI DSS 4.0

PCI DSS 4.0 to SOC 2 PCI DSS 4.0 to NIST CSF 2.0 PCI DSS 4.0 to ISO 27001:2022 PCI DSS 4.0 to HIPAA Security Rule