Skip to content

    SOC 2 Type II to PCI DSS v4.0.1 control mapping

    SOC 2 Type II and PCI DSS v4.0.1 both map to 185 NIST SP 800-53 controls. Every one is listed below, with the controls on each side that map to it.

    Shared NIST 800-53 controls
    185
    SOC 2 Type II controls involved
    51
    PCI DSS v4.0.1 controls involved
    292
    NIST 800-53 families touched
    20

    How this pairing is derived

    Both frameworks are mapped to NIST SP 800-53 Rev 5 in the source dataset, so the ground they share is the set of NIST controls they both reference. That set is what the table shows. It is not an authored SOC 2 Type II to PCI DSS v4.0.1 crosswalk: two controls on the same row are related through the NIST control between them, not asserted to be equivalent to each other.

    Shared controls in full

    NIST SP 800-53 Rev 5 controls mapped by both SOC 2 Type II and PCI DSS v4.0.1, with the controls on each side that map to them.
    NIST 800-53 controlFamilySOC 2 Type II controlsPCI DSS v4.0.1 controls
    AC-1Policy and ProceduresACAccess ControlCC5.3, CC6.1, CC6.61.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1, 7.1.1, 7.2, 7.2.1, 7.3, 7.3.1, 7.3.2, 7.3.3, 8.1, 8.1.1, 8.2, 8.3.3, 8.3.8, 8.5.1, 8.6.1, 9.1.1, A3.4
    AC-2Account ManagementACAccess ControlCC6.1, CC6.611.2, 4.1, 4.2.1, 8.2.4, 8.2.5, 8.3.10, 8.6, 8.6.1
    AC-2(7)Privileged User AccountsACAccess ControlCC6.1, CC6.31.3, 7.1, 7.2, 7.2.1, 7.2.2, 7.2.5, 7.3, 7.3.1, 7.3.2, 7.3.3
    AC-2(12)Account Monitoring for Atypical UsageACAccess ControlCC7.23.1, A3.2.6.1
    AC-2(13)Disable Accounts for High-risk IndividualsACAccess ControlCC1.58.2.5
    AC-3Access EnforcementACAccess ControlCC6.1, CC6.611.2, 4.1, 4.2.1, 7.2.1, 7.2.2, 7.2.5, 7.2.6
    AC-4Information Flow EnforcementACAccess ControlCC6.1, CC6.61.1, 1.3, 1.3.1, 1.3.2, 1.4.2, 1.4.3
    AC-4(21)Physical or Logical Separation of Information FlowsACAccess ControlCC6.11.2.1, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.3, 1.3.1, 1.3.2, 1.3.3, 1.4.1, 1.4.2, 11.4.5, 11.4.6, 12.5.2, A1.1.4, A3.2.1, A3.2.4
    AC-4(25)Data SanitizationACAccess ControlC1.2, CC6.5, P4.2, P4.310.5.1, 9.4.6, 9.4.7
    AC-5Separation of DutiesACAccess ControlCC5.1, CC6.611.2, 4.1, 4.2.1, 6.5.4
    AC-6Least PrivilegeACAccess ControlCC6.11.3, 3.4, 3.4.2, 7.1, 7.2, 7.2.1, 7.2.2, 7.2.5, 7.2.6, 7.3, 7.3.1, 7.3.2, 7.3.3, 8.6, 8.6.1
    AC-6(7)Review of User PrivilegesACAccess ControlCC6.27.2.4, 7.2.5.1, A3.4.1
    AC-17Remote AccessACAccess ControlCC6.612.8.1, 3.4.2, 7.2.5, 8.2.3, 8.2.7
    AC-17(6)Protection of Mechanism InformationACAccess ControlCC6.612.8.1, 3.4.2, 7.2.5, 8.2.3, 8.2.7
    AC-23Data Mining ProtectionACAccess ControlP4.16.5.5
    AT-1Policy and ProceduresATAwareness and TrainingCC1.4, CC5.31.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 12.6, 12.6.1, 12.6.2, 12.6.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1, 9.5.1, 9.5.1.3, A3.1.4
    AU-1Policy and ProceduresAUAudit and AccountabilityCC5.3, CC7.21.1.1, 10.1, 10.1.1, 10.4.3, 10.7, 10.7.1, 10.7.2, 10.7.3, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1, A3.3.1, A3.5
    AU-2Event LoggingAUAudit and AccountabilityCC7.2, CC7.310.3.3, 10.4, 10.4.1, 10.4.1.1, 10.4.2, 10.4.2.1, 10.4.3, 12.4.2
    AU-3Content of Audit RecordsAUAudit and AccountabilityPI1.410.2, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 6.4.2
    AU-6Audit Record Review, Analysis, and ReportingAUAudit and AccountabilityCC7.2, CC7.310.3.3, 10.4, 10.4.1, 10.4.1.1
    AU-6(3)Correlate Audit Record RepositoriesAUAudit and AccountabilityCC7.2, CC7.310.4.1.1, 12.10.5
    AU-6(9)Correlation with Information from Nontechnical SourcesAUAudit and AccountabilityCC7.2, CC7.310.4.1.1, 12.10.5
    AU-9Protection of Audit InformationAUAudit and AccountabilityPI1.4, PI1.510.3, 10.3.1, 10.3.2
    AU-11Audit Record RetentionAUAudit and AccountabilityC1.210.5, 10.5.1
    CA-1Policy and ProceduresCAAssessment, Authorization, and MonitoringCC4.1, CC5.31.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1
    CA-2Control AssessmentsCAAssessment, Authorization, and MonitoringCC3.1, CC4.1, CC5.21.1, 1.2.7, 10.7, 10.7.1, 10.7.2, 10.7.3, 11.1, 12.4.2
    CA-7Continuous MonitoringCAAssessment, Authorization, and MonitoringCC1.1, CC2.2, CC2.310.7, 10.7.1, 10.7.2, 10.7.3
    CA-7(1)Independent AssessmentCAAssessment, Authorization, and MonitoringCC1.1, CC2.2, CC2.310.7, 10.7.1, 10.7.2, 10.7.3
    CM-1Policy and ProceduresCMConfiguration ManagementCC5.3, CC7.11.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1, 2.1.1, 2.2, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 8.5, 9.1.1
    CM-2Baseline ConfigurationCMConfiguration ManagementCC7.1, CC8.11.1, 1.2.1, 1.2.6, 10.2, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.6, 10.6.1, 10.6.2, 10.6.3, 11.2, 12.4.2, 2.2, 2.2.1, 8.3.2, 8.5
    CM-3Configuration Change ControlCMConfiguration ManagementCC3.4, CC8.11.2.2, 12.4.2, 6.5, 6.5.1, 6.5.2, 6.5.3, 6.5.6
    CM-3(1)Automated Documentation, Notification, and Prohibition of ChangesCMConfiguration ManagementCC6.81.2.2, 6.5, 6.5.1
    CM-3(2)Testing, Validation, and Documentation of ChangesCMConfiguration ManagementCC3.4, CC8.110.7.3, 6.5, 6.5.1, 6.5.2, A3.2.2.1
    CM-3(7)Review System ChangesCMConfiguration ManagementCC3.4, CC8.16.5, 6.5.1, 6.5.2, A3.2.2.1
    CM-4Impact AnalysesCMConfiguration ManagementCC3.46.5.2, 6.5.6, A3.2.2, A3.2.3
    CM-6Configuration SettingsCMConfiguration ManagementCC7.1, CC8.11.1, 1.2.1, 1.2.6, 10.2, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.6, 10.6.1, 10.6.2, 10.6.3, 11.2, 2.2, 2.2.1, 8.3.2, 8.5
    CM-9Configuration Management PlanCMConfiguration ManagementCC7.1, CC8.12.1, 2.2, 8.5
    CP-1Policy and ProceduresCPContingency PlanningA1.2, CC5.3, CC7.5, CC9.11.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1
    CP-9System BackupCPContingency PlanningA1.2, CC7.512.10.1, 9.4.1.1, 9.4.1.2
    CP-9(3)Separate Storage for Critical InformationCPContingency PlanningA1.29.4.1.1
    IA-1Policy and ProceduresIAIdentification and AuthenticationCC5.3, CC6.1, CC6.61.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1, 7.1.1, 7.2, 7.2.1, 7.3, 7.3.1, 7.3.2, 7.3.3, 8.1, 8.1.1, 8.2, 8.3.3, 8.3.8, 8.5.1, 8.6.1, 9.1.1, A3.4
    IA-2Identification and Authentication (Organizational Users)IAIdentification and AuthenticationCC6.17.1, 7.2, 7.2.1, 7.3, 7.3.1, 7.3.2, 7.3.3, 8.1, 8.2, 8.3, 8.3.3, 8.3.9
    IA-4Identifier ManagementIAIdentification and AuthenticationCC6.1, CC6.68.2, 8.2.1
    IA-4(4)Identify User StatusIAIdentification and AuthenticationCC6.1, CC6.68.2, 8.2.1
    IA-5Authenticator ManagementIAIdentification and AuthenticationCC6.12.2.2, 2.3.1, 6.5.2, 8.2.4, 8.3, 8.3.1, 8.3.10.1, 8.3.11, 8.3.3, 8.3.5, 8.3.7, 8.3.9, 8.6.3
    IA-5(1)Password-based AuthenticationIAIdentification and AuthenticationCC6.18.2.4, 8.3, 8.3.1, 8.3.10.1, 8.3.11, 8.3.3, 8.3.5, 8.3.6, 8.3.7, 8.3.9, 8.6.3
    IA-5(5)Change Authenticators Prior to DeliveryIAIdentification and AuthenticationCC6.12.2.2, 2.3.1, 6.5.2
    IA-8Identification and Authentication (Non-organizational Users)IAIdentification and AuthenticationCC6.17.2.1
    IA-9Service Identification and AuthenticationIAIdentification and AuthenticationCC6.18.2.3
    IA-12(4)In-person Validation and VerificationIAIdentification and AuthenticationCC6.27.2.3, 8.2.4, 8.3.5
    IR-1Policy and ProceduresIRIncident ResponseCC5.3, CC7.3, CC7.41.1.1, 10.1.1, 10.7, 10.7.1, 10.7.2, 10.7.3, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 12.10, 12.10.2, 12.10.6, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1, A3.5
    IR-4Incident HandlingIRIncident ResponseCC7.3, CC7.412.10, 12.10.5
    IR-4(3)Continuity of OperationsIRIncident ResponseA1.2, CC7.5, CC9.112.10
    IR-4(4)Information CorrelationIRIncident ResponseCC7.2, CC7.310.3.3, 10.4, 10.4.1, 10.4.1.1, 12.10.5
    IR-4(10)Supply Chain CoordinationIRIncident ResponseCC7.3, CC7.4, P6.5, P6.610.7, 10.7.1, 10.7.2, 10.7.3
    IR-4(11)Integrated Incident Response TeamIRIncident ResponseCC7.412.10.3
    IR-4(13)Behavior AnalysisIRIncident ResponseCC7.23.1, A3.2.6.1
    IR-5Incident MonitoringIRIncident ResponseCC7.4A3.3.1
    IR-6Incident ReportingIRIncident ResponseCC2.3, CC7.4, P6.3, P6.712.1.4, 12.10.1, A1.2.3
    IR-8Incident Response PlanIRIncident ResponseCC7.3, CC7.412.10, 12.10.1, 12.10.5, 12.10.7
    IR-9Information Spillage ResponseIRIncident ResponseP6.312.10.7, A3.2.5.2
    MA-1Policy and ProceduresMAMaintenanceCC5.31.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.2.7, 8.3.8, 9.1.1
    PE-1Policy and ProceduresPEPhysical and Environmental ProtectionA1.2, CC5.3, CC6.41.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 9.1, 9.1.1, 9.2
    PE-2Physical Access AuthorizationsPEPhysical and Environmental ProtectionCC6.48.3.11, 9.1, 9.2, 9.2.1, 9.3, 9.3.1
    PE-2(1)Access by Position or RolePEPhysical and Environmental ProtectionCC6.48.3.11, 9.1, 9.2, 9.2.1, 9.3, 9.3.1, 9.3.1.1
    PE-3Physical Access ControlPEPhysical and Environmental ProtectionCC6.49.1, 9.1.2, 9.2, 9.2.1
    PE-3(2)Facility and SystemsPEPhysical and Environmental ProtectionCC6.49.1, 9.1.2, 9.2, 9.2.1
    PE-3(3)Continuous GuardsPEPhysical and Environmental ProtectionCC6.49.1, 9.1.2, 9.2, 9.2.1
    PE-5Access Control for Output DevicesPEPhysical and Environmental ProtectionPI1.49.2.2, 9.2.3
    PE-18Location of System ComponentsPEPhysical and Environmental ProtectionA1.29.2.2, 9.2.3, 9.2.4
    PE-23Facility LocationPEPhysical and Environmental ProtectionA1.2, CC6.4, CC9.112.5.2, 3.2.1, 9.1, 9.1.1, 9.2, 9.2.2, 9.2.3, 9.2.4
    PL-1Policy and ProceduresPLPlanningCC1.5, CC2.2, CC2.3, CC3.1, CC3.4, CC5.2, CC5.3, PI1.2, PI1.31.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 12.4, 12.4.2, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 6.2, 6.2.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1, A3.1, A3.1.1
    PL-2System Security and Privacy PlansPLPlanningCC2.1, CC4.11.2.3, 1.2.4
    PL-4Rules of BehaviorPLPlanningCC1.112.1.3, 12.2, 12.2.1
    PL-8Security and Privacy ArchitecturesPLPlanningCC3.1, CC4.1, CC5.11.2
    PL-9Central ManagementPLPlanningCC1.1, CC1.3, CC5.11.1, 1.1.2, 10.1.2, 10.7, 10.7.1, 10.7.2, 10.7.3, 11.1.2, 12.1.3, 12.1.4, 12.4, 2.1.2, 3.1.2, 4.1.2, 5.1.2, 5.3.4, 6.1.2, 6.3, 6.3.1, 6.3.2, 6.3.3, 6.4, 6.4.1, 6.4.2, 6.4.3, 7.1.2, 8.1.2, 9.1.2, A3.1.1, A3.1.3
    PL-10Baseline SelectionPLPlanningCC7.1, CC8.11.1, 1.2.1, 1.2.6, 10.2, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.6, 10.6.1, 10.6.2, 10.6.3, 11.2, 2.2, 2.2.1, 8.3.2, 8.5
    RA-1Policy and ProceduresRARisk AssessmentCC3.1, CC4.1, CC5.1, CC5.3, CC9.11.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 12.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1
    RA-2Security CategorizationRARisk AssessmentCC3.29.4.2
    RA-3Risk AssessmentRARisk AssessmentA1.2, CC4.1, CC7.31.2.7, 10.7, 10.7.1, 10.7.2, 10.7.3, 11.1, 12.3, 12.3.1, 12.3.2, 12.4.2
    RA-5Vulnerability Monitoring and ScanningRARisk AssessmentCC7.111.3, 11.3.1, 11.3.1.1, 11.3.1.2, 11.3.1.3, 11.3.2, 11.3.2.1, 6.4.1
    RA-8Privacy Impact AssessmentsRARisk AssessmentCC3.2, CC5.2, PI1.1A3.2.2
    RA-9Criticality AnalysisRARisk AssessmentCC2.2, CC4.1, CC5.2, CC9.1, PI1.11.1
    SA-1Policy and ProceduresSASystem and Services AcquisitionCC5.2, CC5.3, P6.4, PI1.1, PI1.2, PI1.3, PI1.4, PI1.51.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 6.2, 6.2.1, 6.2.4, 7.1.1, 8.1.1, 8.3.8, 9.1.1
    SA-3System Development Life CycleSASystem and Services AcquisitionCC5.2, CC8.112.3.4
    SA-3(1)Manage Preproduction EnvironmentSASystem and Services AcquisitionCC5.2, CC8.111.4.5, 11.4.6, 12.3.4, 6.5.3
    SA-4Acquisition ProcessSASystem and Services AcquisitionCC3.3, CC3.4, CC5.2, CC9.1, CC9.2, P6.4, PI1.2, PI1.312.8, 12.8.1, 12.9, 12.9.1, 12.9.2, 6.2, 6.2.1, 8.2.3, A2.1.3
    SA-4(1)Functional Properties of ControlsSASystem and Services AcquisitionCC2.11.2.3, 1.2.4
    SA-4(2)Design and Implementation Information for ControlsSASystem and Services AcquisitionCC2.11.2.3, 1.2.4
    SA-4(3)Development Methods, Techniques, and PracticesSASystem and Services AcquisitionPI1.1, PI1.2, PI1.3, PI1.4, PI1.56.2, 6.2.1, 6.2.4
    SA-4(12)Data OwnershipSASystem and Services AcquisitionCC2.12.2.2, 2.2.4, 2.2.5, 6.5.2, 9.4.1
    SA-8Security and Privacy Engineering PrinciplesSASystem and Services AcquisitionCC2.2, CC3.2, CC5.1, CC5.2, CC7.1, CC8.11.1, 1.2, 1.2.1, 1.2.6, 10.2, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.6, 10.6.1, 10.6.2, 10.6.3, 11.2, 2.2, 2.2.1, 6.1, 6.2, 6.2.1, 8.3.2, 8.5, 8.5.1
    SA-8(14)Least PrivilegeSASystem and Services AcquisitionCC6.11.3, 3.4, 3.4.2, 7.1, 7.2, 7.2.1, 7.2.2, 7.2.6, 7.3, 7.3.1, 7.3.2, 7.3.3, 8.6, 8.6.1
    SA-8(30)Procedural RigorSASystem and Services AcquisitionCC5.2, CC8.112.3.4
    SA-8(31)Secure System ModificationSASystem and Services AcquisitionCC3.4, CC8.11.2.2, 10.7.3, 12.4.2, 6.5, 6.5.1, 6.5.2, 6.5.6, A3.2.2.1
    SA-8(32)Sufficient DocumentationSASystem and Services AcquisitionCC2.2, CC5.1, CC5.31.1.1, 10.1.1, 11.1.1, 2.1.1, 3.1.1, 3.7, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 6.5.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1, 9.3.2
    SA-9External System ServicesSASystem and Services AcquisitionCC3.3, P6.412.8.2, 12.9, 12.9.1, 12.9.2, 8.2.3
    SA-9(1)Risk Assessments and Organizational ApprovalsSASystem and Services AcquisitionCC3.4, CC9.212.8.3
    SA-9(3)Establish and Maintain Trust Relationship with ProvidersSASystem and Services AcquisitionCC3.1, CC3.2, CC3.3, CC4.1, CC9.1, CC9.212.4.1, 12.8.2, 12.8.5, 12.9, 12.9.1, 12.9.2
    SA-9(5)Processing, Storage, and Service LocationSASystem and Services AcquisitionCC9.112.5.2, 3.2.1
    SA-11(2)Threat Modeling and Vulnerability AnalysesSASystem and Services AcquisitionCC4.211.4.1, 11.4.4, 12.4.2.1, 6.2.1, 6.2.2, 6.2.3, 6.2.3.1, 6.2.4, 6.3.1, 6.4.1, 6.4.2, A1.2.3
    SA-11(5)Penetration TestingSASystem and Services AcquisitionCC4.1, CC4.211.4, 11.4.1, 11.4.2, 11.4.3, 11.4.4, 11.4.5, 11.4.6, 11.4.7, 12.4.2.1, 6.2.1, 6.2.2, 6.2.3, 6.2.3.1, 6.2.4, 6.3.1, 6.4.1, 6.4.2, 6.5.6, A1.2.3, A3.2.4
    SA-15Development Process, Standards, and ToolsSASystem and Services AcquisitionPI1.1, PI1.2, PI1.3, PI1.4, PI1.56.2, 6.2.1, 6.2.4
    SA-15(5)Attack Surface ReductionSASystem and Services AcquisitionCC2.2, CC3.2, CC5.1, CC5.2, CC7.1, CC8.11.1, 1.2, 1.2.1, 1.2.6, 10.2, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.6, 10.6.1, 10.6.2, 10.6.3, 11.2, 2.2, 2.2.1, 6.1, 6.2, 6.2.1, 8.3.2, 8.5, 8.5.1
    SA-23SpecializationSASystem and Services AcquisitionCC5.2, PI1.2, PI1.36.2, 6.2.1
    SC-1Policy and ProceduresSCSystem and Communications ProtectionCC2.2, CC3.2, CC5.1, CC5.2, CC5.3, CC6.1, CC6.61.1, 1.1.1, 1.2, 10.1.1, 11.1.1, 11.2.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1, 6.1.1, 6.2, 6.2.1, 7.1.1, 8.1.1, 8.3.8, 8.5, 8.5.1, 9.1.1
    SC-7Boundary ProtectionSCSystem and Communications ProtectionCC6.1, CC6.6, CC6.81.3.3, 1.4, 1.4.1, 1.4.2, 11.5.1
    SC-7(3)Access PointsSCSystem and Communications ProtectionCC6.1, CC6.61.4.2, 11.2.1
    SC-7(5)Deny by Default — Allow by ExceptionSCSystem and Communications ProtectionCC6.61.3, 1.3.1, 1.3.2, 1.3.3, 1.4.2
    SC-7(9)Restrict Threatening Outgoing Communications TrafficSCSystem and Communications ProtectionCC6.1, CC6.6, CC6.81.3.3, 1.4, 1.4.1, 1.4.2, 11.5.1
    SC-7(11)Restrict Incoming Communications TrafficSCSystem and Communications ProtectionCC6.1, CC6.6, CC6.81.3, 1.3.1, 1.3.2, 1.3.3, 1.4, 1.4.1, 1.4.2, 11.5.1
    SC-7(14)Protect Against Unauthorized Physical ConnectionsSCSystem and Communications ProtectionA1.29.2.2, 9.2.3, 9.2.4
    SC-7(18)Fail SecureSCSystem and Communications ProtectionCC2.2, CC3.2, CC5.1, CC5.21.2, 6.1, 6.2, 6.2.1, 8.5, 8.5.1
    SC-7(27)Unclassified Non-national Security System ConnectionsSCSystem and Communications ProtectionCC6.11.4.4
    SC-7(29)Separate Subnets to Isolate FunctionsSCSystem and Communications ProtectionCC6.11.4, 1.4.1
    SC-8Transmission Confidentiality and IntegritySCSystem and Communications ProtectionCC6.1, CC6.73.7.5, 4.2, 4.2.1, 4.2.1.2, 8.3.2, A2.1, A2.1.1, A2.1.2
    SC-8(1)Cryptographic ProtectionSCSystem and Communications ProtectionCC6.1, CC6.712.3.3, 2.2.7, 3.3.2, 4.2, 4.2.1, 4.2.1.2, 8.3.2, A2.1, A2.1.1, A2.1.2
    SC-8(2)Pre- and Post-transmission HandlingSCSystem and Communications ProtectionCC6.1, CC6.712.3.3, 2.2.7, 3.3.2, 8.3.2
    SC-13Cryptographic ProtectionSCSystem and Communications ProtectionCC6.1, CC6.712.3.3, 2.2.7, 3.3.2, 3.5, 3.5.1.2, 3.5.1.3, 8.3.2, 9.4
    SC-18(1)Identify Unacceptable Code and Take Corrective ActionsSCSystem and Communications ProtectionCC4.211.3, 11.3.1, 11.3.1.1, 11.3.1.2, 11.3.1.3, 11.3.2, 11.3.2.1, 6.3.3
    SC-28Protection of Information at RestSCSystem and Communications ProtectionCC6.1, CC6.71.5, 1.5.1, 3.3.2, 3.5, 3.5.1.2, 3.5.1.3, 8.3.2, 9.4
    SC-28(1)Cryptographic ProtectionSCSystem and Communications ProtectionA1.2, CC6.1, CC6.73.3.2, 3.5, 3.5.1.2, 3.5.1.3, 3.7.5, 8.3.2, 9.4
    SC-28(2)Offline StorageSCSystem and Communications ProtectionA1.2, CC7.512.10.1, 9.4.1.1, 9.4.1.2
    SC-28(3)Cryptographic KeysSCSystem and Communications ProtectionCC6.13.5.1.1, 3.6, 3.6.1, 3.6.1.1, 3.6.1.2, 3.6.1.3, 3.6.1.4, 3.7, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.6, 3.7.7, 4.2.1.1
    SC-38Operations SecuritySCSystem and Communications ProtectionCC2.21.1.1, 10.1.1, 11.1.1, 2.1.1, 3.1.1, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1, 9.3.2
    SC-40Wireless Link ProtectionSCSystem and Communications ProtectionCC6.61.2.3, 1.3.3, 11.2, 11.2.1, 11.2.2, 12.10.1, 12.10.5, 2.3, 2.3.1, 2.3.2, 4.2.1.2
    SC-48Sensor RelocationSCSystem and Communications ProtectionCC7.210.4, 10.4.1, 10.4.1.1
    SI-1Policy and ProceduresSISystem and Information IntegrityCC2.2, CC3.2, CC5.1, CC5.2, CC5.31.1.1, 1.2, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1, 6.1.1, 6.2, 6.2.1, 7.1.1, 8.1.1, 8.3.8, 8.5, 8.5.1, 9.1.1
    SI-3Malicious Code ProtectionSISystem and Information IntegrityCC6.6, CC6.811.2, 11.3, 4.1, 4.2.1, 5.2, 5.2.1, 5.2.2, 5.3, 5.3.1, 5.3.2, 5.3.2.1, 5.3.3, 5.3.4, 5.3.5, 6.3, 6.3.1, 6.3.3
    SI-4System MonitoringSISystem and Information IntegrityCC6.6, CC7.2, CC7.310.1, 10.3.3, 10.4, 10.4.1, 10.4.1.1, 10.4.3, 10.7, 10.7.1, 10.7.2, 10.7.3, 11.2, 4.1, 4.2.1, A3.3.1, A3.5
    SI-4(1)System-wide Intrusion Detection SystemSISystem and Information IntegrityCC7.21.4.3, 11.5, 11.5.1, 11.5.1.1
    SI-4(2)Automated Tools and Mechanisms for Real-time AnalysisSISystem and Information IntegrityCC7.210.4, 10.4.1, 10.4.1.1
    SI-4(5)System-generated AlertsSISystem and Information IntegrityCC7.210.2, 10.4, 10.4.1, 10.4.1.1, 10.4.3, 10.7, 10.7.1, 10.7.2, 10.7.3
    SI-4(11)Analyze Communications Traffic AnomaliesSISystem and Information IntegrityCC7.23.1, A3.2.6.1
    SI-4(14)Wireless Intrusion DetectionSISystem and Information IntegrityCC7.211.2
    SI-4(15)Wireless to Wireline CommunicationsSISystem and Information IntegrityCC7.21.4.3, 11.2
    SI-4(16)Correlate Monitoring InformationSISystem and Information IntegrityCC7.2, CC7.310.4.1.1, 12.10.5
    SI-4(24)Indicators of CompromiseSISystem and Information IntegrityCC6.8, CC7.110.3.4, 10.4, 11.5, 11.5.2, 11.6.1
    SI-4(25)Optimize Network Traffic AnalysisSISystem and Information IntegrityCC6.1, CC6.6, CC7.21.4.2, 1.4.3, 11.2.1, 11.5, 11.5.1, 11.5.1.1
    SI-5Security Alerts, Advisories, and DirectivesSISystem and Information IntegrityCC6.611.2, 4.1, 4.2.1, 6.3.1
    SI-7Software, Firmware, and Information IntegritySISystem and Information IntegrityCC6.6, CC6.810.3.4, 11.2, 11.5, 11.5.2, 11.6.1, 4.1, 4.2.1
    SI-7(6)Cryptographic ProtectionSISystem and Information IntegrityCC6.112.3.3, 2.2.7, 3.3.2, 8.3.2
    SI-7(7)Integration of Detection and ResponseSISystem and Information IntegrityCC7.310.7, 10.7.1, 10.7.2, 10.7.3
    SI-10Information Input ValidationSISystem and Information IntegrityCC6.611.2, 4.1, 4.2.1
    SI-12Information Management and RetentionSISystem and Information IntegrityC1.2, CC6.5, P4.2, P4.3, PI1.510.5, 10.5.1, 11.4.1, 3.2, 3.2.1, 9.4.6, 9.4.7
    SI-12(1)Limit Personally Identifiable Information ElementsSISystem and Information IntegrityP4.16.5.5
    SI-12(2)Minimize Personally Identifiable Information in Testing, Training, and ResearchSISystem and Information IntegrityP4.16.5.5
    SI-12(3)Information DisposalSISystem and Information IntegrityC1.2, CC6.5, P4.2, P4.310.5.1, 9.4.6, 9.4.7
    MP-1Policy and ProceduresMPMedia ProtectionC1.1, CC2.1, CC5.3, CC6.5, CC6.7, PI1.51.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1, 9.4, 9.4.1
    MP-2Media AccessMPMedia ProtectionC1.11.5, 1.5.1, 5.1
    MP-6Media SanitizationMPMedia ProtectionCC6.5, P4.39.4, 9.4.6, 9.4.7
    MP-6(3)Nondestructive TechniquesMPMedia ProtectionCC6.5, P4.39.4.7
    MP-7Media UseMPMedia ProtectionCC6.7, PI1.510.5, 10.5.1, 11.4.1, 3.2, 3.2.1, 9.4.6, 9.4.7
    PS-1Policy and ProceduresPSPersonnel SecurityCC1.1, CC1.4, CC5.31.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 12.2, 12.2.1, 12.7, 12.7.1, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1
    PS-2Position Risk DesignationPSPersonnel SecurityCC1.2, CC1.3, CC1.5, CC5.312.7, 12.7.1, 6.2.2
    PS-4Personnel TerminationPSPersonnel SecurityCC1.58.2.5
    PS-9Position DescriptionsPSPersonnel SecurityCC1.2, CC1.3, CC2.21.1.2, 10.1.2, 11.1.2, 12.1.3, 12.10.1, 2.1.2, 3.1.2, 3.7.8, 4.1.2, 5.1.2, 6.1.2, 7.1.2, 8.1.2, 9.1.2, A3.1.3
    PM-1Information Security Program PlanPMProgram ManagementCC1.1, CC1.2, CC5.31.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 12.4, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1, A3.1.2
    PM-2Information Security Program Leadership RolePMProgram ManagementCC1.1, CC1.31.1.2, 10.1.2, 11.1.2, 12.1.3, 12.1.4, 12.4, 2.1.2, 3.1.2, 4.1.2, 5.1.2, 6.1.2, 7.1.2, 8.1.2, 9.1.2, A3.1.1, A3.1.3
    PM-4Plan of Action and Milestones ProcessPMProgram ManagementCC4.211.3, 11.3.1, 11.3.1.1, 11.3.1.2, 11.3.1.3, 11.3.2, 11.3.2.1
    PM-6Measures of PerformancePMProgram ManagementCC1.1, CC1.2, CC1.3, CC1.5, CC2.2, CC4.11.1.2, 10.1.2, 11.1.2, 12.1.3, 12.1.4, 12.4, 2.1.2, 3.1.2, 4.1.2, 5.1.2, 6.1.2, 7.1.2, 8.1.2, 9.1.2, A3.1.1, A3.1.3
    PM-7Enterprise ArchitecturePMProgram ManagementCC3.1, CC4.1, CC5.11.2
    PM-8Critical Infrastructure PlanPMProgram ManagementA1.2, CC1.5, CC2.2, CC2.3, CC7.5, CC9.112.4, 12.4.2, A3.1, A3.1.1
    PM-9Risk Management StrategyPMProgram ManagementCC3.1, CC4.1, CC5.1, CC9.112.3
    PM-13Security and Privacy WorkforcePMProgram ManagementCC1.2, CC1.3, CC1.4, CC2.21.1.2, 10.1.2, 11.1.2, 12.1.3, 12.10.1, 12.6, 12.6.1, 12.6.2, 12.6.3, 2.1.2, 3.1.2, 3.7.8, 4.1.2, 5.1.2, 6.1.2, 7.1.2, 8.1.2, 8.3.8, 9.1.2, 9.5.1, 9.5.1.3, A3.1.3, A3.1.4
    PM-14Testing, Training, and MonitoringPMProgram ManagementCC1.1, CC2.2, CC2.310.7, 10.7.1, 10.7.2, 10.7.3, A3.1.4
    PM-15Security and Privacy Groups and AssociationsPMProgram ManagementCC2.3, CC3.3, CC9.16.3, 6.3.1, A3.5.1
    PM-16Threat Awareness ProgramPMProgram ManagementCC3.3, CC9.16.3, A3.5.1
    PM-23Data Governance BodyPMProgram ManagementP7.1A3.2.5
    PM-24Data Integrity BoardPMProgram ManagementP7.1A3.2.5
    PM-25Minimization of Personally Identifiable Information Used in Testing, Training, and ResearchPMProgram ManagementP4.16.5.5, 9.3.4
    PM-28Risk FramingPMProgram ManagementCC3.212.3.1, 12.3.2
    PM-29Risk Management Program Leadership RolesPMProgram ManagementCC1.1, CC1.3, CC3.1, CC3.2, CC4.1, CC5.1, CC9.1, CC9.21.1.2, 10.1.2, 11.1.2, 12.1.3, 12.1.4, 12.3, 12.4, 2.1.2, 3.1.2, 4.1.2, 5.1.2, 6.1.2, 7.1.2, 8.1.2, 9.1.2, A3.1.1, A3.1.3
    PM-31Continuous Monitoring StrategyPMProgram ManagementCC7.210.1, 10.4.3, 10.7, 10.7.1, 10.7.2, 10.7.3, A3.3.1, A3.5
    PT-1Policy and ProceduresPTPII Processing and TransparencyCC2.2, CC3.2, CC5.1, CC5.2, CC5.31.1.1, 1.2, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1, 6.1.1, 6.2, 6.2.1, 7.1.1, 8.1.1, 8.3.8, 8.5, 8.5.1, 9.1.1
    PT-2Authority to Process Personally Identifiable InformationPTPII Processing and TransparencyP3.1, P4.16.5.5
    PT-3Personally Identifiable Information Processing PurposesPTPII Processing and TransparencyP4.16.5.5
    PT-7Specific Categories of Personally Identifiable InformationPTPII Processing and TransparencyP4.16.5.5
    SR-1Policy and ProceduresSRSupply Chain Risk ManagementCC3.3, CC5.3, CC9.1, CC9.21.1.1, 10.1.1, 11.1.1, 12.1, 12.1.1, 12.1.2, 12.1.3, 12.8, 12.8.1, 12.9, 12.9.1, 12.9.2, 2.1.1, 3.1.1, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.2.3, 8.3.8, 9.1.1, A2.1.3
    SR-3(1)Diverse Supply BaseSRSupply Chain Risk ManagementCC3.3, CC9.16.2, 6.2.1
    SR-3(3)Sub-tier Flow DownSRSupply Chain Risk ManagementCC9.112.4.2, 12.4.2.1, 12.8.2, 12.8.5, 12.9, 12.9.1, 12.9.2, 8.2.3
    SR-6Supplier Assessments and ReviewsSRSupply Chain Risk ManagementCC3.4, CC9.112.4.2, 12.4.2.1, 12.8.4
    SR-6(1)Testing and AnalysisSRSupply Chain Risk ManagementCC3.4, CC9.112.4.2, 12.4.2.1, 12.8.4
    SR-7Supply Chain Operations SecuritySRSupply Chain Risk ManagementCC2.2, CC3.1, CC3.2, CC4.1, CC9.21.1.1, 10.1.1, 11.1.1, 2.1.1, 3.1.1, 4.1.1, 5.1.1, 6.1.1, 7.1.1, 8.1.1, 8.3.8, 9.1.1, 9.3.2
    SR-12Component DisposalSRSupply Chain Risk ManagementCC6.59.4.7

    Source and method

    Derived from the Top Floor framework mapping dataset: 4,123 cross-framework control mappings across 19 frameworks, every one pivoted through NIST SP 800-53 Rev 5.

    Cross-framework mappings on this page are derived from the 2026.2 release of the Secure Controls Framework, used under CC BY-ND 4.0.

    Mappings are illustrative aids for planning and are not a substitute for the official text of any framework or for an assessor’s judgment. Always verify control requirements against the authoritative publication. Where no official crosswalk exists, the mapping judgment is our own analysis.