Home/Compliance
pci-dss-4

PCI-DSS v4.0. Security Controls

75 controls · cross-mapped to ATT&CK techniques
Translate between regulatory language and what attackers actually do. Each control maps to MITRE ATT&CK techniques; open a control to see those techniques and whether we hold detection coverage for them.
NIST 800-53 (1246)NIST CSF (106)ISO 27001:2022 (93)PCI-DSS v4.0 (75)CIS v8.1 (62)CRI Profile (60)CSA CCM v4 (57)SOC 2 TSC (57)OWASP API (10)OWASP Mobile (10)OWASP Web (10)
75
Total controls
0%
Detection coverage
0
Covered controls
75
Coverage gaps
▤ Export audit (CSV) Coverage report Self-assessment Showing gaps only ×
▶ Check your own detection coverage

Paste the ATT&CK technique IDs you have Sigma/YARA rules for (one per line, e.g. T1059, T1190). The controls below will update to show YOUR coverage instead of ours.

Red team insight A pci-dss-4 compliant org should have detection for the green-tagged techniques below. Controls showing no technique coverage are likely blind spots. Use gaps view to enumerate unmonitored attack paths.
▤

Controls

58 shown of 75
1.1
Processes and mechanisms for installing and maintaining network security controls are defined and understood
high
family Network Security framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PL-1 ↗nist-800-53: SC-7 ↗
1.2
Network security controls (NSCs) are configured and maintained
high
family Network Security framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CM-2 ↗nist-800-53: CM-6 ↗nist-800-53: SC-7 ↗
1.4
Network connections between trusted and untrusted networks are controlled
high
family Network Security framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AC-4 ↗nist-800-53: SC-7 ↗
1.5
Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated
high
family Network Security framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CM-6 ↗nist-800-53: SC-7 ↗nist-800-53: SI-3 ↗
10
Log and Monitor All Access to System Components and Cardholder Data
high
family Audit Logging framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AU-12 ↗nist-800-53: AU-2 ↗nist-800-53: AU-3 ↗nist-800-53: AU-6 ↗
10.1
Processes and mechanisms for logging and monitoring all access to system components and cardholder data are defined and documented
high
family Audit Logging framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AU-2 ↗nist-800-53: PL-1 ↗
10.2
Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events
high
family Audit Logging framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AU-12 ↗nist-800-53: AU-2 ↗nist-800-53: AU-3 ↗
10.3
Audit logs are protected from destruction and unauthorized modifications
high
family Audit Logging framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AU-11 ↗nist-800-53: AU-9 ↗
10.4
Audit logs are reviewed to identify anomalies or suspicious activity
high
family Audit Logging framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AU-6 ↗nist-800-53: SI-4 ↗
10.5
Retain audit log history for at least 12 months
high
family Audit Logging framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AU-11 ↗
10.6
Time-synchronization mechanisms support consistent time settings across all systems
high
family Audit Logging framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AU-8 ↗
10.7
Failures of critical security controls are detected, reported, and responded to promptly
high
family Audit Logging framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AU-6 ↗nist-800-53: IR-4 ↗nist-800-53: IR-5 ↗
11
Test Security of Systems and Networks Regularly
high
family Security Testing framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CA-2 ↗nist-800-53: CA-8 ↗nist-800-53: RA-5 ↗
11.1
Processes and mechanisms for regularly testing security of systems and networks are defined and understood
high
family Security Testing framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CA-2 ↗nist-800-53: PL-1 ↗
11.2
Wireless access points are identified and monitored
high
family Security Testing framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CA-7 ↗nist-800-53: SC-7 ↗
11.3
External and internal vulnerabilities are regularly identified, prioritized, and addressed
high
family Security Testing framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CA-7 ↗nist-800-53: RA-5 ↗nist-800-53: SI-2 ↗
11.4
External and internal penetration testing is regularly performed
high
family Security Testing framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CA-8 ↗nist-800-53: RA-5 ↗
11.5
Network intrusions and unexpected file changes are detected and responded to
high
family Security Testing framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IR-4 ↗nist-800-53: SI-4 ↗
11.6
Unauthorized changes on payment pages are detected and responded to
high
family Security Testing framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CA-7 ↗nist-800-53: SI-4 ↗
12
Support Information Security with Organizational Policies and Programs
high
family Security Policy framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PL-1 ↗nist-800-53: PM-1 ↗nist-800-53: PM-9 ↗
12.1
A comprehensive information security policy that governs and provides direction for protection of the entity's information assets is known and current
high
family Security Policy framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PL-1 ↗nist-800-53: PM-1 ↗
12.10
Suspected and confirmed security incidents that could impact the CDE are responded to immediately
high
family Security Policy framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IR-4 ↗nist-800-53: IR-8 ↗
12.2
Acceptable use policies for end-user technologies are defined and implemented
high
family Security Policy framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CM-6 ↗nist-800-53: PL-4 ↗
12.3
Risks to the cardholder data environment are formally identified, evaluated, and managed
high
family Security Policy framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PM-9 ↗nist-800-53: RA-3 ↗
12.4
PCI DSS compliance is managed throughout the year
high
family Security Policy framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CA-7 ↗nist-800-53: PM-3 ↗
12.5
PCI DSS scope is documented and validated
high
family Security Policy framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CA-6 ↗nist-800-53: CM-8 ↗
12.6
Security awareness education is an ongoing activity
high
family Security Policy framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AT-2 ↗nist-800-53: AT-3 ↗
12.7
Personnel are screened to reduce risks from insider threats
high
family Security Policy framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PS-3 ↗nist-800-53: PS-6 ↗
12.8
Risk to information assets associated with third-party service provider (TPSP) relationships is managed
high
family Security Policy framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: SA-9 ↗nist-800-53: SR-3 ↗
12.9
Third-party service providers (TPSPs) support their customers' PCI DSS compliance
high
family Security Policy framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: SA-9 ↗
2
Apply Secure Configurations to All System Components
high
family Secure Configurations framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CM-6 ↗nist-800-53: CM-7 ↗
2.1
Processes and mechanisms for applying secure configurations are defined and understood
high
family Secure Configurations framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CM-1 ↗nist-800-53: CM-6 ↗nist-800-53: PL-1 ↗
2.2
System components are configured and managed securely
high
family Secure Configurations framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CM-2 ↗nist-800-53: CM-6 ↗nist-800-53: CM-7 ↗
2.3
Wireless environments are configured and managed securely
high
family Secure Configurations framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CM-6 ↗nist-800-53: IA-5 ↗nist-800-53: SC-7 ↗
4.1
Processes and mechanisms for protecting cardholder data with strong cryptography during transmission over open, public networks are defined and documented
high
family Cryptography in Transit framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PL-1 ↗nist-800-53: SC-8 ↗
5
Protect All Systems and Networks from Malicious Software
high
family Malware Protection framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: SI-3 ↗nist-800-53: SI-8 ↗
5.1
Processes and mechanisms for protecting all systems and networks from malicious software are defined and understood
high
family Malware Protection framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PL-1 ↗nist-800-53: SI-3 ↗
5.2
Malicious software (malware) is prevented, or detected and addressed
high
family Malware Protection framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: SI-3 ↗nist-800-53: SI-8 ↗
5.3
Anti-malware mechanisms and processes are active, maintained, and monitored
high
family Malware Protection framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CA-7 ↗nist-800-53: SI-3 ↗
5.4
Anti-phishing mechanisms protect users against phishing attacks
high
family Malware Protection framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AT-2 ↗nist-800-53: SI-8 ↗
6.1
Processes and mechanisms for developing and maintaining secure systems and software are defined and understood
high
family Secure Development framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PL-1 ↗nist-800-53: SA-3 ↗
6.3
Security vulnerabilities are identified and addressed
high
family Secure Development framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: RA-5 ↗nist-800-53: SI-2 ↗
7
Restrict Access to System Components and Cardholder Data by Business Need to Know
high
family Access Control framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AC-24 ↗nist-800-53: AC-3 ↗nist-800-53: AC-6 ↗
7.1
Processes and mechanisms for restricting access to system components and cardholder data by business need to know are defined and understood
high
family Access Control framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AC-3 ↗nist-800-53: PL-1 ↗
7.2
Access to system components and data is appropriately defined and assigned
high
family Access Control framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AC-2 ↗nist-800-53: AC-3 ↗nist-800-53: AC-6 ↗
7.3
Access to system components and data is managed via an access control system(s)
high
family Access Control framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AC-2 ↗nist-800-53: AC-3 ↗nist-800-53: CM-6 ↗
8
Identify Users and Authenticate Access to System Components
high
family Identity & Authentication framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IA-1 ↗nist-800-53: IA-2 ↗nist-800-53: IA-5 ↗
8.1
Processes and mechanisms for identifying users and authenticating access to system components are defined and understood
high
family Identity & Authentication framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IA-1 ↗nist-800-53: PL-1 ↗
8.3
User authentication for users and administrators is established and managed
high
family Identity & Authentication framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IA-3 ↗nist-800-53: IA-5 ↗nist-800-53: IA-8 ↗
8.4
Multi-factor authentication (MFA) is implemented to secure access into the CDE
high
family Identity & Authentication framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IA-2 ↗
8.5
Multi-factor authentication (MFA) systems are configured to prevent misuse
high
family Identity & Authentication framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CM-6 ↗nist-800-53: IA-2 ↗
8.6
Use of application and system accounts and associated authentication factors is strictly managed
high
family Identity & Authentication framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AC-2 ↗nist-800-53: CM-7 ↗nist-800-53: IA-5 ↗
9
Restrict Physical Access to Cardholder Data
high
family Physical Security framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PE-2 ↗nist-800-53: PE-3 ↗nist-800-53: PE-5 ↗
9.1
Processes and mechanisms for restricting physical access to cardholder data are defined and understood
high
family Physical Security framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PE-2 ↗nist-800-53: PL-1 ↗
9.2
Physical access controls manage entry into facilities and systems containing cardholder data
high
family Physical Security framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PE-2 ↗nist-800-53: PE-3 ↗
9.3
Physical access for personnel and visitors is authorized and managed
high
family Physical Security framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PE-3 ↗nist-800-53: PE-8 ↗
9.4
Media with cardholder data is securely stored, accessed, distributed, and destroyed
high
family Physical Security framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: MP-2 ↗nist-800-53: MP-4 ↗nist-800-53: MP-5 ↗nist-800-53: MP-6 ↗
9.5
Point of interaction (POI) devices are protected from tampering and unauthorized substitution
high
family Physical Security framework pci-dss-4
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CM-8 ↗nist-800-53: PE-3 ↗
Showing 1-75 of 75
Prev 1 Next
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin