Crossfoot / Crosswalks / PCI DSS 4.0 to SOC 2
Draft v0.1.028 of 28 objectives have a direct match
PCI DSS 4.0 to SOC 2 crosswalk
28 control objectives in PCI DSS are mapped here to SOC 2 Trust Services Criteria. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.
| Control objective | PCI DSS 4.0 | SOC 2 |
|---|---|---|
| Security governance and policies | 12.1A comprehensive information security policy is established, published, maintained and disseminated12.4PCI DSS compliance is managed | CC1.1Demonstrates commitment to integrity and ethical valuesCC1.2Board exercises oversight responsibilityCC5.3Deploys control activities through policies and procedures |
| Security roles and accountability | 12.1.3Security policy defines information security roles and responsibilities12.4.1Executive management responsibility for protection of cardholder data (service providers) | CC1.3Establishes structure, authority and responsibilityCC1.5Enforces accountability |
| Risk assessment and treatment | 12.3Risks to the cardholder data environment are formally identified, evaluated and managed12.3.1Targeted risk analysis for requirements with flexible frequency | CC3.1Specifies suitable objectivesCC3.2Identifies and analyzes riskCC3.3Considers potential for fraudCC3.4Identifies and assesses significant changes |
| Asset and system inventory | 12.5.1Inventory of system components in scope for PCI DSS is maintained12.5.2PCI DSS scope is documented and confirmed at least every 12 months | CC6.1Logical access security (inventory of information assets is a point of focus) |
| Data classification and handling | 12.5.2PCI DSS scope is documented and confirmed (includes identifying all data flows) | C1.1Identifies and maintains confidential information |
| Access provisioning, review and removal | 7.2Access to system components and data is appropriately defined and assigned (incl. 7.2.4 six-month review)7.3Access is managed via an access control system8.2.5Access for terminated users is immediately revoked | CC6.2Registers and authorizes new users prior to issuing credentialsCC6.3Authorizes, modifies or removes access based on roles |
| Least privilege and privileged access | 7.2.1An access control model is defined7.2.2Access assigned based on job classification and least privileges | CC6.3Role-based access and least privilege |
| Authentication, unique IDs and multi-factor authentication | 8.2User identification and related accounts are strictly managed8.3Strong authentication for users and administrators is established and managed8.4Multi-factor authentication is implemented8.5MFA systems are configured to prevent misuse | CC6.1Logical access security software, infrastructure and architectures |
| Encryption at rest and key management | 3.5Primary account number is secured wherever it is stored3.6Cryptographic keys used to protect stored account data are secured3.7Key management processes and procedures are defined and implemented | CC6.1Logical access security (encryption of data at rest) |
| Encryption in transit | 4.2PAN is protected with strong cryptography during transmission2.2.7All non-console administrative access is encrypted | CC6.7Restricts transmission, movement and removal of information |
| Network security and segmentation | 1.2Network security controls are configured and maintained1.3Network access to and from the cardholder data environment is restricted1.4Network connections between trusted and untrusted networks are controlled | CC6.6Implements logical access security measures against threats from outside system boundaries |
| Secure configuration and hardening | 2.2System components are configured and managed securely | CC7.1Uses detection and monitoring procedures to identify changes to configurations |
| Vulnerability scanning and patching | 6.3Security vulnerabilities are identified and addressed11.3External and internal vulnerabilities are regularly identified, prioritized and addressed | CC7.1Detection and monitoring procedures identify vulnerabilities |
| Penetration testing and independent assessment | 11.4External and internal penetration testing is regularly performed | CC4.1Selects, develops and performs ongoing and/or separate evaluationsCC7.1Detection and monitoring procedures |
| Logging, log review and monitoring | 10.2Audit logs are implemented to support detection of anomalies and suspicious activity10.3Audit logs are protected from destruction and unauthorized modification10.4Audit logs are reviewed to identify anomalies or suspicious activity10.5Audit log history is retained and available for analysis10.6Time-synchronization mechanisms support consistent time settings | CC7.2Monitors system components for anomalies indicative of malicious acts, natural disasters and errors |
| Intrusion detection and integrity monitoring | 11.5Network intrusions and unexpected file changes are detected and responded to11.6Unauthorized changes on payment pages are detected and responded to | CC7.2Monitors system components for anomaliesCC6.8Prevents or detects unauthorized or malicious software |
| Malware protection | 5.2Malicious software is prevented, or detected and addressed5.3Anti-malware mechanisms and processes are active, maintained and monitored5.4Anti-phishing mechanisms protect users against phishing attacks | CC6.8Implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software |
| Incident response and breach notification | 12.10Suspected and confirmed security incidents that could impact the CDE are responded to immediately (12.10.1 IR plan, 12.10.2 annual review and test) | CC7.3Evaluates security events to determine whether they are incidentsCC7.4Responds to identified security incidentsCC7.5Identifies, develops and implements activities to recover from incidents |
| Change management | 6.5Changes to all system components are managed securely (6.5.1 change control procedures) | CC8.1Authorizes, designs, develops, configures, documents, tests, approves and implements changes |
| Secure software development | 6.2Bespoke and custom software is developed securely6.4Public-facing web applications are protected against attacks | CC8.1Changes are developed, tested and approved |
| Third-party and vendor risk management | 12.8Risk to information assets associated with third-party service provider relationships is managed12.9Third-party service providers support their customers' PCI DSS compliance | CC9.2Assesses and manages risks associated with vendors and business partners |
| Business continuity and disaster recovery | 12.10.1Incident response plan includes business recovery and continuity procedures | CC9.1Identifies, selects and develops risk mitigation activities for business disruptionsA1.2Environmental protections, software, data backup processes and recovery infrastructureA1.3Tests recovery plan procedures |
| Backup and redundancy | 12.10.1Incident response plan includes data backup processes9.4.1.1Offline media backups with cardholder data are stored in a secure location | A1.2Data backup processes and recovery infrastructure |
| Security awareness and training | 12.6Security awareness education is an ongoing activity (12.6.1 program, 12.6.2 annual review, 12.6.3 training at hire and annually) | CC1.4Demonstrates commitment to attract, develop and retain competent individualsCC2.2Internally communicates information necessary to support internal control |
| Personnel screening, terms and sanctions | 12.7Personnel are screened to reduce risks from insider threats | CC1.4Hiring and competence practicesCC6.3Removes access on termination |
| Physical access and facility security | 9.2Physical access controls manage entry into facilities and systems containing cardholder data9.3Physical access for personnel and visitors is authorized and managed | CC6.4Restricts physical access to facilities and protected information assets |
| Data retention, media handling and secure disposal | 3.2Storage of account data is kept to a minimum (3.2.1 retention and disposal)9.4Media with cardholder data is securely stored, accessed, distributed and destroyed | CC6.5Discontinues logical and physical protections over assets only after the ability to read or recover data is diminishedC1.2Disposes of confidential information |
| Ongoing control monitoring and internal audit | 12.4.2Reviews confirm personnel perform tasks per policy (service providers) | CC4.1Selects, develops and performs ongoing and/or separate evaluationsCC4.2Evaluates and communicates internal control deficiencies |
Open a control objective for the evidence checklist.SOC 2 to PCI DSS 4.0 →
Scope: Mapped at requirement / sub-requirement level. Many PCI requirements only apply to the cardholder data environment (CDE) or to service providers. Security (CC series), Availability (A1) and Confidentiality (C1). Processing Integrity and Privacy are not covered in this dataset version. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.