PCI DSS 4.0 8.3.8: 8.3.8 Authentication policies communicated to users

What else in your programme already covers this

This control maps to 34 controls across 18 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27701:2019 · 4 controls

5.5.3 Awareness
5.5.4 Communication
6.2.1 Management direction for information security
6.6.3 User responsibilities

ISO 22301:2019 · 3 controls

5.2.2 Communicating the business continuity policy
7.4 Communication
7.5.1 General

ISO 27001:2022 · 3 controls

5.1 Policies for information security
5.17 Authentication information
6.3 Information security awareness, education and training

ISO 27002:2022 · 3 controls

5.1 Policies for information security
5.17 Authentication information
6.3 Information security awareness, education and training

CMMC 2.0 · 2 controls

AT.L2-3.2.1 Role-Based Risk Awareness
AT.L2-3.2.2 Role-Based Training

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-HRS-11 Security Awareness Training
CCM-IAM-02 Strong Password Policy and Procedures

FedRAMP High · 2 controls

IA-1 Policy and Procedures
PL-4 Rules of Behavior

FedRAMP Moderate · 2 controls

IA-1 Policy and Procedures
PL-4 Rules of Behavior

NIST SP 800-53 Rev 5 · 2 controls

NIST800-AT-2 AT-2 Literacy Training and Awareness
NIST800-IA-1 IA-1 Policy and Procedures

SOC 2 · 2 controls

SOC2-CC2.1 CC2.1 Relevant, quality information to support internal control (COSO principle 13)
SOC2-CC2.2 CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)

UK Cyber Essentials · 2 controls

CE-SC.7 Educate Users on Strong Passwords
CE-SC.8 Process for Compromised Passwords

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-10 Define and Verify Password Selection and Sizing Rules

C5 (Germany) · 1 control

C5-IDM-08 Confidentiality of authentication information

CIS Controls v8 · 1 control

CIS-14.3 Train Workforce Members on Authentication Best Practices

HIPAA Security Rule · 1 control

164.308(a)(5)(ii)(D) Password Management (Addressable)

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

NIST SP 800-171 Rev 3 · 1 control

03.15.03 Rules of Behavior

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(5)(ii)(D) Password Management (Addressable)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of PCI DSS 4.0 have you already done?

PCI DSS 4.0 8.3.8 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.

If you hold ISO 27001:202249.6% covered · 141 gaps If you hold FedRAMP Moderate49.3% covered · 142 gaps If you hold NIST SP 800-53 Rev 547.5% covered · 147 gaps If you hold ISO 27002:202243.2% covered · 159 gaps If you hold CIS Controls v838.2% covered · 173 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.136.4% covered · 178 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free