Frameworks / PSD2 SCA / PSDTWO-1 PSD2 SCA PSDTWO-1: Strong Customer Authentication (SCA) Core Requirements Per PSD2 Regulatory Technical Standards (RTS) on SCA + Common and Secure Communication: implement SCA. Requirements include (a) implement Strong Customer Authentication using two or more independent elements from knowledge (password + PIN) + possession (mobile + token + card) + inherence (biometric) for (i) account access + (ii) electronic payment initiation + (iii) any action involving risk of fraud or other abuse + (b) maintain element independence - compromise of one does not compromise others + (c) implement dynamic linking for electronic payment transactions binding amount + payee to authentication code + (d) maintain SCA mechanism resilience against replay + interception + (e) document SCA implementation + risk assessment.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 288 controls across 117 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
FFIEC-03 Risk appetite and tolerance for IT risk FFIEC-05 Roles and responsibilities definition FFIEC-06 Network security and segmentation FFIEC-07 Endpoint protection and detection FFIEC-08 Application security controls FFIEC-18 Ongoing monitoring and assessment FFIEC-20 Exit strategy and transition planning PCI-P2PE-05 Roles and responsibilities definition PCI-P2PE-06 Network security and segmentation PCI-P2PE-07 Endpoint protection and detection PCI-P2PE-08 Application security controls PCI-P2PE-16 Due diligence and onboarding PCI-P2PE-18 Ongoing monitoring and assessment PCI-P2PE-19 Concentration risk management PCI-PIN-05 Roles and responsibilities definition PCI-PIN-06 Network security and segmentation PCI-PIN-07 Endpoint protection and detection PCI-PIN-08 Application security controls PCI-PIN-16 Due diligence and onboarding PCI-PIN-18 Ongoing monitoring and assessment PCI-PIN-19 Concentration risk management PCI-SSF-03 Risk appetite and tolerance for IT risk PCI-SSF-05 Roles and responsibilities definition PCI-SSF-06 Network security and segmentation PCI-SSF-07 Endpoint protection and detection PCI-SSF-08 Application security controls PCI-SSF-16 Due diligence and onboarding PCI-SSF-17 Contractual security requirements IEC62304-4.1 Quality Management System IEC62304-5.1 Software Development Planning IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures IEC62304-7.4 Risk Management of Software Changes ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-5.1 Leadership and Commitment ISO23894-5.2 AI Risk Management Integration ISO23894-5.5 Framework Evaluation ISO23894-6.2 Scope, Context and Criteria 27557-1 Scope 27557-3 Terms and definitions 27557-6.2 Scope, context, and criteria for privacy 27557-6.4 Privacy risk treatment 27557-6.6 Recording and reporting 27557-7.3 Risk-based privacy program implementation NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle ASD37-12 Antivirus software with heuristics (Very Good) ASD37-16 Antivirus software with signatures (Limited) ASD37-20 Multi-factor authentication (Essential) ASD37-22 Network segmentation (Excellent) ASD37-25 Software firewall - inbound (Very Good) 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements 60601-1.4.2 Risk management process 60601-1.5.1 General requirements for testing ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-5.6 Risk management ISO-15189-6.7 Service agreements ISO-22320-4.3 Risk-based approach ISO-22320-5.1 General process requirements ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities 27011-1 Scope 27011-3 Terms and definitions 27011-6.3 Awareness and Training 27011-8.2 Network security and segregation IM8-DSS.3 Secure Development Practices IM8-RES.2 Disaster Recovery IM8-SEC.3 Network Security IM8-TPM.4 Supply Chain Risk Management CPS230-16 Internal Audit Review of the Business Continuity Plan CPS230-37 Service Provider Management Policy CPS230-46 Ongoing Risk Management of Each Material Arrangement AWWA-1.1 Security Policy and Governance AWWA-3.1 Network Segmentation AWWA-4.1 Malware Protection CPG-1.D Revoking Credentials for Departing Employees CPG-6.B Supply Chain Incident Reporting CPG-8.A Network Segmentation IS.D.OR.210 Information Security Risk Treatment IS.I.OR.210 Information Security Risk Treatment IS.I.OR.220 Information Security Risk Management CAT-D1-2 Risk management CAT-D3-1 Preventative controls CAT-ML-2 Evolving ICP-1 Objectives, Powers and Responsibilities of the Supervisor ICP-16 Enterprise Risk Management for Solvency Purposes ICP-8 Risk Management and Internal Controls ISO-19650-1-4 Information management concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-3-5.3 Trigger events for information exchange ISO-20400-4.2 Principles of sustainable procurement ISO-20400-4.5 Key considerations for sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO28001-PI-01 Personnel Security Screening ISO28001-PS-01 Facility Security ISO28001-SA-04 Security Risk Treatment Planning ISO27003-4.3 Determining the scope of the information security management system ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.3 Information security risk treatment 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles ISMSP-AC-04 Network Access Control ISMSP-MS-02 Risk Management ISMSP-SYS-04 Vulnerability Management 58.1 Scope 58.3 Definitions API1164-13 Business Continuity and Recovery API1164-21 TSA Pipeline Security Directive Alignment CPS234-16 Assessment of Related Party and Third Party Capability CPS234-20 Information Asset Classification AL-DPA-1 Scope and Definitions AL-DPA-3 Lawful Basis for Processing AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training BS65000-RM-01 Resilience Journey BS65000-RM-02 Integrated Approach DA-1 Enterprise Data Architecture DIQ-2 Data Quality Management FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup FDBR-702 Definitions (§501.702) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) IEC62443-13 Network security monitoring IEC62443-21 Supply chain risk management for critical components ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27014-1 Scope 27014-3 Terms and definitions ISO27019-13 Network security monitoring ISO27019-21 Supply chain risk management for critical components ISO27043-04 Roles and responsibilities definition ISO27043-27 Network security management 27400-3 Terms and definitions 27400-6.3 Secure Update Mechanism 29147-3 Terms and definitions 29147-9.2 Contact mechanisms and scope 30111-3 Terms and definitions 30111-5.1 Organizational policy ISO21434-04 Roles and responsibilities definition ISO21434-27 Network security management STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation OWASPSAMM-1 Governance: Strategy, Policy, Compliance, Education, Champions OWASPSAMM-5 Operations: Incident Management, Environment Management, Operational Management PTESPHASE-1 Pre-Engagement Interactions and Scoping PTESPHASE-4 Vulnerability Analysis PICERL-P2 Risk Assessment PICERL-P3 CSIRT Formation C1 Organizational Boundary C3 Scope 1 and 2 Coverage CFR211-A-3 Section 211.3 - Definitions AMLCTF-82 Part A Compliance APPI-A31 Provision of Personally Referable Information AS9100D-8.1 Operational Planning and Control 4.4.1 Resources, Roles, Responsibility, and Authority P1-S2 Risk-Management Systems AZ-DPA-2 Article 2 - Basic Concepts BH-PDPL-18 Regular security testing and assessment COBIT-BAI02 Managed requirements definition CJIS-19 Supply Chain Risk Management CA-9 Internal System Connections CA-9 Internal System Connections UAE-PDPL-Art.25_26_27_28_29 UAE Data Office establishment, powers, penalties, complaints (UAE PDPL Articles 25-29) Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) 62351-2 Glossary of terms ISO-14064-1-5.1 Organizational boundaries ISO-26262-3-5 Item definition 27007-5.2 Audit Programme Objectives 27010-13.1 Communications Security 27050-1.4 Terms and definitions 29115-3 Terms and definitions 29134-3 Terms and definitions BIPA-SEC5-1 Biometric Identifier Definition 2.2.2 2.2.2 Vendor default accounts managed PHILCC-1 Computer Crime Offences (Illegal Access, Interference, Misuse of Devices) PSPF24-1 Security Culture, Governance, Risk Management QATAR-5 Security of Processing EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1) AIGF-1.1 Risk Management and Internal Controls TEFCAREC-1 Common Agreement Conformance and Onboarding TURKEYKVKK-2 Information Notice and Data Subject Rights CRM-3 Risk Management Framework OB-OPS.2 Performance Standards CPSC-CS.1 Network Security for Connected Products USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern CYB-3 Device Security Measures USMCADIGITAL-1 Cross-Border Data Flows and Localisation VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VIETNAMPDP-2 Consent and Notice W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 288 it maps to, and the evidence behind each claim, over MCP and REST.