TheArtOfService
NIST SP 800-172PCI DSS 4.0

NIST SP 800-172 covers 10.8% of PCI DSS 4.0

27 of the 249 controls in PCI DSS 4.0 are already satisfied by evidence you collected for NIST SP 800-172. 222 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

10.8%
of the target already covered
27
controls evidenced
222
genuine gaps
6
claims rejected in review

This number is directional. It says how much of PCI DSS 4.0 your NIST SP 800-172 evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

63 candidate mappings were examined and 6 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

Req 11: Test Security Regularly6 of 21 evidenced, 15 to do
Req 12: Information Security Policies10 of 37 evidenced, 27 to do
Req 8: Identify and Authenticate Users4 of 29 evidenced, 25 to do
Req 1: Network Security Controls2 of 19 evidenced, 17 to do
Req 6: Secure Systems and Software2 of 19 evidenced, 17 to do
Req 10: Logging and Monitoring2 of 27 evidenced, 25 to do
Req 3: Protect Stored Account Data1 of 29 evidenced, 28 to do
Req 2: Secure Configurations0 of 11 evidenced, 11 to do
Req 4: Protect Cardholder Data in Transit0 of 6 evidenced, 6 to do
Req 5: Anti-Malware0 of 13 evidenced, 13 to do
Req 7: Restrict Access by Need to Know0 of 12 evidenced, 12 to do
Req 9: Restrict Physical Access0 of 26 evidenced, 26 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

3.1.3e1.3.1argued against and upheld
Inbound traffic to CDE restricted

Secure transfer solutions control what may enter a security domain from connected systems.

3.1.3e1.3.2argued against and upheld
Outbound traffic from CDE restricted

Controlling information flows between security domains restricts outbound traffic from the protected domain.

3.11.3e10.4.1.1argued against and upheld
Automated mechanisms for log review

Advanced automation and analytics supporting analysts is the automated log review mechanism required.

3.14.2e10.4.3argued against and upheld
Exceptions and anomalies addressed

Continuous monitoring for anomalous behaviour with action on detection addresses exceptions and anomalies.

3.12.1e11.4.1argued against and upheld
Penetration testing methodology defined

Penetration testing conducted at least annually with automated tooling and expert tests defines the methodology.

3.12.1e11.4.2argued against and upheld
Internal penetration testing annually

Annual penetration testing including expert ad hoc tests covers internal testing cadence.

3.12.1e11.4.3argued against and upheld
External penetration testing annually

Penetration testing at least annually by independent agents covers external testing.

3.14.2e11.5.1argued against and upheld
IDS/IPS in place

Ongoing monitoring with specialized advanced detection capabilities is intrusion detection and prevention.

Claims that did not hold

6 proposed mappings for this pair were rejected. They are kept in the graph rather than deleted, so what was thrown out is as inspectable as what survived. A crosswalk that never rejects anything is not being judged.

3.13.1e1.3.1
Inbound traffic to CDE restricted

control identity corrected 2026-08-19: issued 3.13.1e is component diversity to limit malicious code propagation; these mappings are boundary protection and segmentation, judged against 3.1.3e's content which this control was wrongly carrying

Claimed at high confidence before it was rejected.

3.13.1e1.4.1
NSCs between trusted and untrusted networks

control identity corrected 2026-08-19: issued 3.13.1e is component diversity to limit malicious code propagation; these mappings are boundary protection and segmentation, judged against 3.1.3e's content which this control was wrongly carrying

Claimed at high confidence before it was rejected.

3.13.1e1.4.2
Inbound traffic from untrusted networks restricted

control identity corrected 2026-08-19: issued 3.13.1e is component diversity to limit malicious code propagation; these mappings are boundary protection and segmentation, judged against 3.1.3e's content which this control was wrongly carrying

Claimed at high confidence before it was rejected.

3.5.3e8.4.1
MFA is implemented for all non-console access into the CDE for personnel with administrative access

corrected 2026-08-19: judged from a title claiming multifactor authentication, while the control carried 3.5.2e password-management text. Issued 800-172 3.5.3e is comply-to-connect: prohibit connection of unknown or unverified components. Authentication evidence does not satisfy it.

Claimed at high confidence before it was rejected.

3.5.3e8.4.2
MFA is implemented for all non-console access into the CDE

corrected 2026-08-19: judged from a title claiming multifactor authentication, while the control carried 3.5.2e password-management text. Issued 800-172 3.5.3e is comply-to-connect: prohibit connection of unknown or unverified components. Authentication evidence does not satisfy it.

Claimed at high confidence before it was rejected.

3.5.3e8.4.3
MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE

corrected 2026-08-19: judged from a title claiming multifactor authentication, while the control carried 3.5.2e password-management text. Issued 800-172 3.5.3e is comply-to-connect: prohibit connection of unknown or unverified components. Authentication evidence does not satisfy it.

Claimed at high confidence before it was rejected.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk