PCI DSS 4.0

Req 6: Secure Systems and Software

PCI DSS 4.0 6.3.1: Security vulnerabilities are identified and managed as follows: • New security vulnerabilities are identified using industry-recognized sources for security vulnerability information, including alerts from international and national computer emergency response teams (CERTs). • Vulnerabilities

Security vulnerabilities are identified and managed as follows: • New security vulnerabilities are identified using industry-recognized sources for security vulnerability information, including alerts from international and national computer emergency response teams (CERTs). • Vulnerabilities

What else in your programme already covers this

This control maps to 136 controls across 28 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 13 controls

RA-5 Vulnerability Monitoring and Scanning
RA-5(11) Vulnerability Monitoring and Scanning | Public Disclosure Program. Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components
RA-5(2) Update Vulnerabilities to be Scanned
SA-11 Developer Testing and Evaluation
SA-11(1) Developer Testing and Evaluation | Static Code Analysis. Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of
SA-11(2) Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses. Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing
SA-15 Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the
SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support
SA-3 System Development Life Cycle
SA-8 Security and Privacy Engineering Principles
SI-2(2) Automated Flaw Remediation Status
SI-2(3) Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions. (a) Measure the time between flaw identification and flaw remediation; and (b) Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined
SI-5 Security Alerts, Advisories, and Directives

FedRAMP Moderate · 13 controls

RA-5 Vulnerability Monitoring and Scanning
RA-5(11) Vulnerability Monitoring and Scanning | Public Disclosure Program. Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components
RA-5(2) Update Vulnerabilities to be Scanned
SA-11 Developer Testing and Evaluation
SA-11(1) Developer Testing and Evaluation | Static Code Analysis. Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of
SA-11(2) Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses. Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing
SA-15 Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the
SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support
SA-3 System Development Life Cycle
SA-8 Security and Privacy Engineering Principles
SI-2(2) Automated Flaw Remediation Status
SI-2(3) Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions. (a) Measure the time between flaw identification and flaw remediation; and (b) Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined
SI-5 Security Alerts, Advisories, and Directives

CIS Controls v8 · 11 controls

CIS-14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates
CIS-16.1 Establish and Maintain a Secure Application Development Process
CIS-16.12 Implement Code-Level Security Checks
CIS-16.2 Establish and Maintain a Process to Accept and Address Software Vulnerabilities
CIS-16.3 Perform Root Cause Analysis on Security Vulnerabilities
CIS-16.5 Use Up-to-Date and Trusted Third-Party Software Components
CIS-16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities
CIS-2.2 Ensure Authorized Software is Currently Supported
CIS-7.1 Establish and Maintain a Vulnerability Management Process
CIS-7.2 Establish and Maintain a Remediation Process
CIS-7.7 Remediate Detected Vulnerabilities

NIST SP 800-53 Rev 5 · 9 controls

NIST800-CM-4 Impact analyses
NIST800-PM-15 Security and Privacy Groups and Associations. Establish and institutionalize contact with selected groups and associations within the security and privacy communities: To facilitate ongoing security and privacy education and training for organizational personnel; To
NIST800-RA-5 Vulnerability monitoring and scanning
NIST800-SA-11 Developer testing and evaluation
NIST800-SA-15 Development process, standards, and tools
NIST800-SA-22 Unsupported System Components
NIST800-SI-2 Flaw remediation
NIST800-SI-5 Security alerts, advisories, and directives
SP800-53-SI System and Information Integrity Family

ISO 27002:2022 · 7 controls

5.6 Contact with special interest groups
5.7 Threat intelligence
8.25 Secure development life cycle
8.27 Secure system architecture and engineering principles
8.28 Secure coding
8.29 Security testing in development and acceptance
8.8 Management of technical vulnerabilities

NIST Cybersecurity Framework 2.0 · 7 controls

NIST-CSF-DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis
NIST-CSF-ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles
NIST-CSF-ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
NIST-CSF-ID.RA-02 Cyber threat intelligence is received from information sharing forums and sources
NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

NIST SP 800-53 Rev 5 MODERATE · 7 controls

RA-5 Vulnerability Monitoring and Scanning
SA-11 Developer Testing and Evaluation
SA-15 Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the
SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support
SA-3 System Development Life Cycle
SA-8 Security and Privacy Engineering Principles
SI-5 Security Alerts, Advisories, and Directives

NIST SP 800-53 Revision 5.1 HIGH · 7 controls

RA-5 Vulnerability Monitoring and Scanning
SA-11 Developer Testing and Evaluation
SA-15 Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the
SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support
SA-3 System Development Life Cycle
SA-8 Security and Privacy Engineering Principles
SI-5 Security Alerts, Advisories, and Directives

CMMC 2.0 · 6 controls

CA.L2-3.12.3 Security Control Monitoring
RA.L2-3.11.2 Vulnerability Scan
RA.L2-3.11.3 Vulnerability Remediation
SC.L2-3.13.2 Security Engineering
SI.L2-3.14.1 Flaw Remediation
SI.L2-3.14.3 Security Alerts & Advisories

SOC 2 · 6 controls

SOC2-CC2.1 COSO principle 13: Obtains and generates relevant, quality information
SOC2-CC3.2 COSO principle 7: Identifies risks and analyzes to determine how managed
SOC2-CC5.2 COSO principle 11: Selects and develops general controls over technology
SOC2-CC6.8 Controls to prevent or detect unauthorized or malicious software
SOC2-CC7.1 Detection and monitoring procedures for security events are in place
SOC2-CC9.1 Identifies, selects and develops risk mitigation activities

ISO 27001:2022 · 5 controls

5.6 Contact with special interest groups
5.7 Threat intelligence
8.26 Application security requirements
8.27 Secure system architecture and engineering principles
8.8 Management of technical vulnerabilities

NIST SP 800-53 Rev 5 LOW · 5 controls

RA-5 Vulnerability Monitoring and Scanning
SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support
SA-3 System Development Life Cycle
SA-8 Security and Privacy Engineering Principles
SI-5 Security Alerts, Advisories, and Directives

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

CCM-AIS-07 Application Vulnerability Remediation
CCM-TVM-01 Threat and Vulnerability Management Policy and Procedures
CCM-TVM-07 Vulnerability Identification
CCM-TVM-08 Vulnerability Prioritization

HIPAA Security Rule · 4 controls

164.308(a)(1)(ii)(A) Risk Analysis (Required)
164.308(a)(1)(ii)(B) Risk Management (Required)
164.308(a)(6)(i) Security Incident Procedures (Standard)
164.308(a)(8) Evaluation (Standard)

NIST SP 800-218 · 4 controls

SP800-218-PW.4.4 Verify Acquired Components Meet Security Requirements
SP800-218-RV.1.1 Identify and Confirm Vulnerabilities on an Ongoing Basis
SP800-218-RV.1.2 Review and Analyze Code for Vulnerabilities
SP800-218-RV.2.1 Assess, Prioritize, and Remediate Vulnerabilities

NIST SP 800-66 Rev 2 · 4 controls

164.308(a)(1)(ii)(A) Risk Analysis (Required)
164.308(a)(1)(ii)(B) Risk Management (Required)
164.308(a)(6)(i) Security Incident Procedures (Standard)
164.308(a)(8) Evaluation (Standard)

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 3 controls

CFTC-SS-13 Vulnerability Testing
CFTC-SS-17 Enterprise Technology Risk Assessment
CFTC-SS-21 Remediation of Vulnerabilities and Deficiencies

NIST SP 800-171 Rev 3 · 3 controls

03.11.02 Vulnerability Monitoring and Scanning
03.14.01 Flaw Remediation
03.14.03 Security Alerts, Advisories, and Directives

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

ANSSI-HYG-34 Define an Update Policy for Information System Components
ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

ASD37-02 Patch applications (Essential)
ASD37-19 Patch operating systems (Essential)

AWS Well-Architected Security Pillar · 2 controls

SEC01-BP04 Stay up to date with security threats and recommendations
SEC06-BP01 Perform vulnerability management

Azure Security Benchmark · 2 controls

DS-2 Ensure software supply chain security
PV-5 Perform vulnerability assessments

C5 (Germany) · 2 controls

C5-OPS-18 Managing Vulnerabilities, Malfunctions and Errors - Concept
C5-PSS-02 Identification of Vulnerabilities of the Cloud Service

ISO 27701:2019 · 2 controls

6.11.2 Security in development and support processes
6.9.6 Technical vulnerability management

NIST SP 800-161 Rev 1 · 2 controls

161R1-RA-5 Vulnerability Monitoring and Scanning
161R1-SI-5 Security Alerts, Advisories, and Directives

NIST SP 800-172 · 2 controls

3.11.1e Threat-Aware Risk Assessment
3.14.6e Use Threat Indicator Information for Detection

ACSC Essential Eight · 1 control

E8-PATCHAPP-ML1 Patch Applications (ML1)

UK Cyber Essentials · 1 control

CE-SU.3 Critical and High Updates within 14 Days

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Req 6: Secure Systems and Software

You are reading one control. How much of PCI DSS 4.0 have you already done?

PCI DSS 4.0 6.3.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 249 PCI DSS 4.0 controls already carry evidence.

If you hold ISO 27001:202255.8% covered · 110 gaps If you hold FedRAMP Moderate55.4% covered · 111 gaps If you hold NIST SP 800-53 Rev 553.4% covered · 116 gaps If you hold ISO 27002:202248.6% covered · 128 gaps If you hold CIS Controls v843% covered · 142 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.141% covered · 147 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free

Query this from an agent

The graph holds this control, the 136 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All PCI DSS 4.0 controls