PCI PIN Security
PCI PIN Security: Third-Party Risk Management

PCI PIN Security PCI-PIN-19: Concentration risk management

Concentration risk management. Control from PCI PIN Security framework, domain: PCI PIN Security: Third-Party Risk Management.

What else in your programme already covers this

This control maps to 128 controls across 56 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 5 controls

SASB Standards · 4 controls

APRA CPS 230 Operational Risk Management · 3 controls

  • CPS230-16 Internal Audit Review of the Business Continuity Plan
  • CPS230-37 Service Provider Management Policy
  • CPS230-46 Ongoing Risk Management of Each Material Arrangement

EASA Part-IS - Information Security in Aviation · 3 controls

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-03 Risk appetite and tolerance for IT risk
  • FFIEC-18 Ongoing monitoring and assessment
  • FFIEC-20 Exit strategy and transition planning

IEC 60601-1 - Medical Electrical Equipment Safety · 3 controls

IEC 62304:2015 Medical Device Software Lifecycle Processes · 3 controls

ISO 27005 · 3 controls

ISO 31000 · 3 controls

ISO/IEC 23894:2023 · 3 controls

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
  • NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders

NIST SP 800-53 Rev 5 · 3 controls

PCI P2PE · 3 controls

PCI SSF · 3 controls

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 3 controls

Security of Critical Infrastructure Act 2018 (SOCI) · 3 controls

Solvency II · 3 controls

APRA CPS 234 · 2 controls

  • CPS234-16 Assessment of Related Party and Third Party Capability
  • CPS234-20 Information Asset Classification

BS 65000:2014 - Guidance on Organizational Resilience · 2 controls

FFIEC Cybersecurity Assessment Tool (CAT) · 2 controls

IAIS Insurance Core Principles (ICPs) · 2 controls

  • ICP-16 Enterprise Risk Management for Solvency Purposes
  • ICP-8 Risk Management and Internal Controls

ISO 37000:2021 - Governance of Organizations · 2 controls

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 2 controls

ISO/IEC 27003:2017 · 2 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 2 controls

  • 3.16 System and Services Acquisition
  • 3.17 Supply Chain Risk Management

PSD2 SCA · 2 controls

  • PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements
  • PSDTWO-3 Common and Secure Communication, API Access for AISPs and PISPs

TISAX - Trusted Information Security Assessment Exchange · 2 controls

AML/CTF Act 2006 (Australia) · 1 control

API 1164 · 1 control

  • API1164-21 TSA Pipeline Security Directive Alignment

APRA SPS 220 Risk Management (Superannuation) · 1 control

  • SPS220-28 Annual Board Risk Management Declaration

AS9100D - Aerospace Quality Management System · 1 control

Aged Care Quality Standards 2019 (repealed edition) · 1 control

Annex 11 to EU GMP - Computerised Systems · 1 control

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

  • P1-S2 Risk-Management Systems

FBI CJIS Security Policy · 1 control

  • CJIS-19 Supply Chain Risk Management

ICAO Annex 17 - Aviation Security (AVSEC) · 1 control

ICH Q10 - Pharmaceutical Quality System · 1 control

IEC 62443 · 1 control

  • IEC62443-21 Supply chain risk management for critical components

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

ISO 20400:2017 - Sustainable Procurement · 1 control

ISO 22320:2018 · 1 control

ISO 27019 · 1 control

  • ISO27019-21 Supply chain risk management for critical components

ISO 28001:2007 Supply Chain Security Management · 1 control

ISO/IEC 38500:2024 - Governance of IT · 1 control

Kuwait National Cybersecurity Framework · 1 control

NIST Privacy Framework · 1 control

  • NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring

NIST SP 1800-32 · 1 control

PIC/S Guide to Good Manufacturing Practice for Medicinal Products · 1 control

  • PICSGMP-1 Chapter 1: Pharmaceutical Quality System (PQS) and Quality Risk Management

SEC Climate Disclosure Rule · 1 control

  • SECCLIM-2 Risk Management: Identification, Assessment, Integration

SSAE 18 - Attestation Standards (SOC Reporting) · 1 control

  • SSAE18-CC9.2 CC9.2 - Vendor and Business Partner Risk Management

Singapore AI Governance Framework · 1 control

  • AIGF-1.1 Risk Management and Internal Controls

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

South Korea ISMS-P · 1 control

Telecommunications Sector Security Reforms (TSSR) · 1 control

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 1 control

  • CRM-3 Risk Management Framework

UK AI Regulation Framework · 1 control

  • UKAI-1 Risk-Based Approach and Pro-Innovation Principles

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in PCI PIN Security: Third-Party Risk Management

Query this from an agent

The graph holds this control, the 128 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll PCI PIN Security controls