SOC 2 to PCI DSS 4.0 crosswalk

29 control objectives in SOC 2 Trust Services Criteria are mapped here to PCI DSS. 1 of them has no direct PCI DSS 4.0 requirement, which is marked in the table. Each row is one shared objective, with the requirement ids on both sides.

Control objective	SOC 2	PCI DSS 4.0
Security governance and policies	`CC1.1`Demonstrates commitment to integrity and ethical values `CC1.2`Board exercises oversight responsibility `CC5.3`Deploys control activities through policies and procedures	`12.1`A comprehensive information security policy is established, published, maintained and disseminated `12.4`PCI DSS compliance is managed
Security roles and accountability	`CC1.3`Establishes structure, authority and responsibility `CC1.5`Enforces accountability	`12.1.3`Security policy defines information security roles and responsibilities `12.4.1`Executive management responsibility for protection of cardholder data (service providers)
Risk assessment and treatment	`CC3.1`Specifies suitable objectives `CC3.2`Identifies and analyzes risk `CC3.3`Considers potential for fraud `CC3.4`Identifies and assesses significant changes	`12.3`Risks to the cardholder data environment are formally identified, evaluated and managed `12.3.1`Targeted risk analysis for requirements with flexible frequency
Asset and system inventory	`CC6.1`Logical access security (inventory of information assets is a point of focus)	`12.5.1`Inventory of system components in scope for PCI DSS is maintained `12.5.2`PCI DSS scope is documented and confirmed at least every 12 months
Data classification and handling	`C1.1`Identifies and maintains confidential information	`12.5.2`PCI DSS scope is documented and confirmed (includes identifying all data flows)
Access provisioning, review and removal	`CC6.2`Registers and authorizes new users prior to issuing credentials `CC6.3`Authorizes, modifies or removes access based on roles	`7.2`Access to system components and data is appropriately defined and assigned (incl. 7.2.4 six-month review) `7.3`Access is managed via an access control system `8.2.5`Access for terminated users is immediately revoked
Least privilege and privileged access	`CC6.3`Role-based access and least privilege	`7.2.1`An access control model is defined `7.2.2`Access assigned based on job classification and least privileges
Authentication, unique IDs and multi-factor authentication	`CC6.1`Logical access security software, infrastructure and architectures	`8.2`User identification and related accounts are strictly managed `8.3`Strong authentication for users and administrators is established and managed `8.4`Multi-factor authentication is implemented `8.5`MFA systems are configured to prevent misuse
Encryption at rest and key management	`CC6.1`Logical access security (encryption of data at rest)	`3.5`Primary account number is secured wherever it is stored `3.6`Cryptographic keys used to protect stored account data are secured `3.7`Key management processes and procedures are defined and implemented
Encryption in transit	`CC6.7`Restricts transmission, movement and removal of information	`4.2`PAN is protected with strong cryptography during transmission `2.2.7`All non-console administrative access is encrypted
Network security and segmentation	`CC6.6`Implements logical access security measures against threats from outside system boundaries	`1.2`Network security controls are configured and maintained `1.3`Network access to and from the cardholder data environment is restricted `1.4`Network connections between trusted and untrusted networks are controlled
Secure configuration and hardening	`CC7.1`Uses detection and monitoring procedures to identify changes to configurations	`2.2`System components are configured and managed securely
Vulnerability scanning and patching	`CC7.1`Detection and monitoring procedures identify vulnerabilities	`6.3`Security vulnerabilities are identified and addressed `11.3`External and internal vulnerabilities are regularly identified, prioritized and addressed
Penetration testing and independent assessment	`CC4.1`Selects, develops and performs ongoing and/or separate evaluations `CC7.1`Detection and monitoring procedures	`11.4`External and internal penetration testing is regularly performed
Logging, log review and monitoring	`CC7.2`Monitors system components for anomalies indicative of malicious acts, natural disasters and errors	`10.2`Audit logs are implemented to support detection of anomalies and suspicious activity `10.3`Audit logs are protected from destruction and unauthorized modification `10.4`Audit logs are reviewed to identify anomalies or suspicious activity `10.5`Audit log history is retained and available for analysis `10.6`Time-synchronization mechanisms support consistent time settings
Intrusion detection and integrity monitoring	`CC7.2`Monitors system components for anomalies `CC6.8`Prevents or detects unauthorized or malicious software	`11.5`Network intrusions and unexpected file changes are detected and responded to `11.6`Unauthorized changes on payment pages are detected and responded to
Malware protection	`CC6.8`Implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software	`5.2`Malicious software is prevented, or detected and addressed `5.3`Anti-malware mechanisms and processes are active, maintained and monitored `5.4`Anti-phishing mechanisms protect users against phishing attacks
Incident response and breach notification	`CC7.3`Evaluates security events to determine whether they are incidents `CC7.4`Responds to identified security incidents `CC7.5`Identifies, develops and implements activities to recover from incidents	`12.10`Suspected and confirmed security incidents that could impact the CDE are responded to immediately (12.10.1 IR plan, 12.10.2 annual review and test)
Change management	`CC8.1`Authorizes, designs, develops, configures, documents, tests, approves and implements changes	`6.5`Changes to all system components are managed securely (6.5.1 change control procedures)
Secure software development	`CC8.1`Changes are developed, tested and approved	`6.2`Bespoke and custom software is developed securely `6.4`Public-facing web applications are protected against attacks
Third-party and vendor risk management	`CC9.2`Assesses and manages risks associated with vendors and business partners	`12.8`Risk to information assets associated with third-party service provider relationships is managed `12.9`Third-party service providers support their customers' PCI DSS compliance
Business continuity and disaster recovery	`CC9.1`Identifies, selects and develops risk mitigation activities for business disruptions `A1.2`Environmental protections, software, data backup processes and recovery infrastructure `A1.3`Tests recovery plan procedures	`12.10.1`Incident response plan includes business recovery and continuity procedures
Backup and redundancy	`A1.2`Data backup processes and recovery infrastructure	`12.10.1`Incident response plan includes data backup processes `9.4.1.1`Offline media backups with cardholder data are stored in a secure location
Capacity and availability management	`A1.1`Maintains, monitors and evaluates current processing capacity	no direct requirement
Security awareness and training	`CC1.4`Demonstrates commitment to attract, develop and retain competent individuals `CC2.2`Internally communicates information necessary to support internal control	`12.6`Security awareness education is an ongoing activity (12.6.1 program, 12.6.2 annual review, 12.6.3 training at hire and annually)
Personnel screening, terms and sanctions	`CC1.4`Hiring and competence practices `CC6.3`Removes access on termination	`12.7`Personnel are screened to reduce risks from insider threats
Physical access and facility security	`CC6.4`Restricts physical access to facilities and protected information assets	`9.2`Physical access controls manage entry into facilities and systems containing cardholder data `9.3`Physical access for personnel and visitors is authorized and managed
Data retention, media handling and secure disposal	`CC6.5`Discontinues logical and physical protections over assets only after the ability to read or recover data is diminished `C1.2`Disposes of confidential information	`3.2`Storage of account data is kept to a minimum (3.2.1 retention and disposal) `9.4`Media with cardholder data is securely stored, accessed, distributed and destroyed
Ongoing control monitoring and internal audit	`CC4.1`Selects, develops and performs ongoing and/or separate evaluations `CC4.2`Evaluates and communicates internal control deficiencies	`12.4.2`Reviews confirm personnel perform tasks per policy (service providers)

Open a control objective for the evidence checklist.PCI DSS 4.0 to SOC 2 →

Scope: Security (CC series), Availability (A1) and Confidentiality (C1). Processing Integrity and Privacy are not covered in this dataset version. Mapped at requirement / sub-requirement level. Many PCI requirements only apply to the cardholder data environment (CDE) or to service providers. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

SOC 2 to PCI DSS 4.0 crosswalk

More from SOC 2