Crossfoot / Crosswalks / PCI DSS 4.0 to NIST CSF 2.0
Draft v0.1.028 of 28 objectives have a direct match
PCI DSS 4.0 to NIST CSF 2.0 crosswalk
28 control objectives in PCI DSS are mapped here to NIST Cybersecurity Framework. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.
| Control objective | PCI DSS 4.0 | NIST CSF 2.0 |
|---|---|---|
| Security governance and policies | 12.1A comprehensive information security policy is established, published, maintained and disseminated12.4PCI DSS compliance is managed | GV.POPolicyGV.OVOversight |
| Security roles and accountability | 12.1.3Security policy defines information security roles and responsibilities12.4.1Executive management responsibility for protection of cardholder data (service providers) | GV.RRRoles, responsibilities and authorities |
| Risk assessment and treatment | 12.3Risks to the cardholder data environment are formally identified, evaluated and managed12.3.1Targeted risk analysis for requirements with flexible frequency | GV.RMRisk management strategyID.RARisk assessment |
| Asset and system inventory | 12.5.1Inventory of system components in scope for PCI DSS is maintained12.5.2PCI DSS scope is documented and confirmed at least every 12 months | ID.AMAsset management |
| Data classification and handling | 12.5.2PCI DSS scope is documented and confirmed (includes identifying all data flows) | ID.AM-07Inventories of data and corresponding metadata are maintainedPR.DSData security |
| Access provisioning, review and removal | 7.2Access to system components and data is appropriately defined and assigned (incl. 7.2.4 six-month review)7.3Access is managed via an access control system8.2.5Access for terminated users is immediately revoked | PR.AA-05Access permissions, entitlements and authorizations are defined and managed (least privilege, separation of duties) |
| Least privilege and privileged access | 7.2.1An access control model is defined7.2.2Access assigned based on job classification and least privileges | PR.AA-05Access permissions managed incorporating least privilege |
| Authentication, unique IDs and multi-factor authentication | 8.2User identification and related accounts are strictly managed8.3Strong authentication for users and administrators is established and managed8.4Multi-factor authentication is implemented8.5MFA systems are configured to prevent misuse | PR.AA-03Users, services and hardware are authenticated |
| Encryption at rest and key management | 3.5Primary account number is secured wherever it is stored3.6Cryptographic keys used to protect stored account data are secured3.7Key management processes and procedures are defined and implemented | PR.DS-01The confidentiality, integrity and availability of data-at-rest are protected |
| Encryption in transit | 4.2PAN is protected with strong cryptography during transmission2.2.7All non-console administrative access is encrypted | PR.DS-02The confidentiality, integrity and availability of data-in-transit are protected |
| Network security and segmentation | 1.2Network security controls are configured and maintained1.3Network access to and from the cardholder data environment is restricted1.4Network connections between trusted and untrusted networks are controlled | PR.IR-01Networks and environments are protected from unauthorized logical access and usage |
| Secure configuration and hardening | 2.2System components are configured and managed securely | PR.PS-01Configuration management practices are established and applied |
| Vulnerability scanning and patching | 6.3Security vulnerabilities are identified and addressed11.3External and internal vulnerabilities are regularly identified, prioritized and addressed | ID.RARisk assessment (vulnerability identification, ID.RA-01)PR.PS-02Software is maintained, replaced and removed commensurate with risk |
| Penetration testing and independent assessment | 11.4External and internal penetration testing is regularly performed | ID.IMImprovement (incl. ID.IM-02, improvements from tests and exercises) |
| Logging, log review and monitoring | 10.2Audit logs are implemented to support detection of anomalies and suspicious activity10.3Audit logs are protected from destruction and unauthorized modification10.4Audit logs are reviewed to identify anomalies or suspicious activity10.5Audit log history is retained and available for analysis10.6Time-synchronization mechanisms support consistent time settings | DE.CMContinuous monitoringPR.PS-04Log records are generated and made available for continuous monitoring |
| Intrusion detection and integrity monitoring | 11.5Network intrusions and unexpected file changes are detected and responded to11.6Unauthorized changes on payment pages are detected and responded to | DE.CMContinuous monitoringDE.AEAdverse event analysis |
| Malware protection | 5.2Malicious software is prevented, or detected and addressed5.3Anti-malware mechanisms and processes are active, maintained and monitored5.4Anti-phishing mechanisms protect users against phishing attacks | PR.PS-05Installation and execution of unauthorized software are preventedDE.CMContinuous monitoring |
| Incident response and breach notification | 12.10Suspected and confirmed security incidents that could impact the CDE are responded to immediately (12.10.1 IR plan, 12.10.2 annual review and test) | RS.MAIncident managementRS.ANIncident analysisRS.COIncident response reporting and communicationRS.MIIncident mitigationDE.AEAdverse event analysis |
| Change management | 6.5Changes to all system components are managed securely (6.5.1 change control procedures) | PR.PS-01Configuration management practices are established and applied |
| Secure software development | 6.2Bespoke and custom software is developed securely6.4Public-facing web applications are protected against attacks | PR.PS-06Secure software development practices are integrated and their performance monitored |
| Third-party and vendor risk management | 12.8Risk to information assets associated with third-party service provider relationships is managed12.9Third-party service providers support their customers' PCI DSS compliance | GV.SCCybersecurity supply chain risk management |
| Business continuity and disaster recovery | 12.10.1Incident response plan includes business recovery and continuity procedures | PR.IR-03Mechanisms are implemented to achieve resilience requirementsRC.RPIncident recovery plan execution |
| Backup and redundancy | 12.10.1Incident response plan includes data backup processes9.4.1.1Offline media backups with cardholder data are stored in a secure location | PR.DS-11Backups of data are created, protected, maintained and tested |
| Security awareness and training | 12.6Security awareness education is an ongoing activity (12.6.1 program, 12.6.2 annual review, 12.6.3 training at hire and annually) | PR.ATAwareness and training |
| Personnel screening, terms and sanctions | 12.7Personnel are screened to reduce risks from insider threats | GV.RR-04Cybersecurity is included in human resources practices |
| Physical access and facility security | 9.2Physical access controls manage entry into facilities and systems containing cardholder data9.3Physical access for personnel and visitors is authorized and managed | PR.AA-06Physical access to assets is managed, monitored and enforced commensurate with risk |
| Data retention, media handling and secure disposal | 3.2Storage of account data is kept to a minimum (3.2.1 retention and disposal)9.4Media with cardholder data is securely stored, accessed, distributed and destroyed | ID.AM-08Systems, hardware, software, services and data are managed throughout their life cycles |
| Ongoing control monitoring and internal audit | 12.4.2Reviews confirm personnel perform tasks per policy (service providers) | ID.IMImprovementGV.OVOversight |
Open a control objective for the evidence checklist.NIST CSF 2.0 to PCI DSS 4.0 →
Scope: Mapped at requirement / sub-requirement level. Many PCI requirements only apply to the cardholder data environment (CDE) or to service providers. Mapped at category level (e.g. PR.AA) or subcategory where one is clearly the match (e.g. PR.AA-05). A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.