PCI DSS 4.0NIST SP 800-218

PCI DSS 4.0 covers 40.5% of NIST SP 800-218

17 of the 42 controls in NIST SP 800-218 are already satisfied by evidence you collected for PCI DSS 4.0. 25 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

40.5%
of the target already covered
17
controls evidenced
25
genuine gaps
0
claims rejected in review

This number is directional. It says how much of NIST SP 800-218 your PCI DSS 4.0 evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

28 candidate mappings were examined and 0 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

Respond to Vulnerabilities2 of 3 evidenced, 1 to do
Prepare the Organization5 of 8 evidenced, 3 to do
Produce Well Secured Software5 of 8 evidenced, 3 to do
NIST SP 800-218: Access Control3 of 5 evidenced, 2 to do
Protect the Software2 of 4 evidenced, 2 to do
NIST SP 800-218: Information Security Policies0 of 5 evidenced, 5 to do
NIST SP 800-218: Asset Management0 of 5 evidenced, 5 to do
NIST SP 800-218: Cryptography0 of 4 evidenced, 4 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

6.2.1SP800-218-PO.1.1argued against and upheld
Define Security Requirements for Software Development

PCI requires bespoke software be developed to industry secure-development standards with security across the lifecycle.

6.1.1SP800-218-PO.1.1argued against and upheld
Define Security Requirements for Software Development

Requirement 6 policies must be documented, current, in use and known to all affected development parties.

6.1.2SP800-218-PO.2.1argued against and upheld
Roles and Responsibilities for Secure Development

Roles and responsibilities for all Requirement 6 development activities are documented, assigned and understood.

6.2.2SP800-218-PO.2.2argued against and upheld
Training and Skills Maintenance

Development personnel are trained at least annually in secure design and secure coding for their language.

6.5.2SP800-218-PO.4.1argued against and upheld
Criteria for Software Security

Applicable security requirements must be confirmed in place on changed systems before the change completes.

6.5.4SP800-218-PO.5.1argued against and upheld
Secure Development Environment Implementation

Roles and functions are separated between production and pre-production so development access is accountable.

6.5.3SP800-218-PO.5.1argued against and upheld
Secure Development Environment Implementation

Pre-production environments must be separated from production and the separation enforced by access controls.

6.5.4SP800-218-PS.1.1argued against and upheld
Protect All Forms of Code from Unauthorized Modification

Separation of roles means no single person can both author and promote a change unreviewed.

Claims that did not hold

Nothing proposed for this pair was rejected in review. That is unusual and worth knowing rather than hiding: it means the candidate set was small and every candidate held.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk