Crosswalk pair

CIS Critical Security Controls and PCI DSS, control by control

16 canonical controls in Keel’s library satisfy clauses of both CIS Critical Security Controls and PCI DSS. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don’t repeat.

Start free with CIS Critical Security Controls + PCI DSS See all pairs

The overlap

What the two libraries have in common

Every figure here counts canonical controls in Keel’s library, not clauses of either standard. Each standard’s own authored count is on its framework page.

16

Controls that satisfy both

Canonical controls that crosswalk to at least one clause of each.

18

In Keel’s library for CIS Critical Security Controls

89% of them also map to PCI DSS.

21

In Keel’s library for PCI DSS

76% of them also map to CIS Critical Security Controls.

69

Evidence artifacts expected

Across the shared controls, from Keel’s evidence guidance. Gathered once.

CIS Critical Security Controls v8.1 89%

16 controls of 18 in Keel’s library for CIS Critical Security Controls also map to PCI DSS.
PCI DSS 4.0.1 76%

16 controls of 21 in Keel’s library for PCI DSS also map to CIS Critical Security Controls.

The mapping

Controls that satisfy both

Each row is one control in Keel’s library and the clauses it answers on each side. Do the work once; both columns are then evidenced by the same artifacts.

CIS Critical Security Controls and PCI DSS controls that satisfy both, with the clauses each maps to
Canonical control	CIS Critical Security Controls clauses	PCI DSS clauses
Access Control
Access control policy Rules for granting, reviewing, and revoking access to systems and data based on business need and least privilege; anyone who works with sensitive data, or in a place from which it can be reached, is individually authorized for that work or supervised while doing it; and a documented emergency route exists to obtain the data when the normal access path is unavailable, with every use of that route recorded and reviewed afterwards.	6.8	7.1, 7.2
Multi-factor authentication Documented procedures verify that a person or system seeking access to sensitive data is the one it claims to be, on every path by which that data can be reached - and multi-factor authentication is the enforced mechanism for remote access, administrative access, and access to sensitive systems and data. The multi-factor mechanism itself is configured so it cannot be bypassed, so the factors it uses are genuinely independent of one another - one factor’s success granting no knowledge of and no route around another - and so access is refused unless every factor required has succeeded.	6.3, 6.5	8.4, 8.5
Password & credential management Rules for the authentication credentials themselves: passwords are unique per account and meet a defined strength standard, a new or changed password is screened against a list of commonly used, expected and compromised passwords and refused if it appears there, a credential issued for first use must be replaced immediately, reuse of previous passwords is refused, changes follow a defined procedure, repeated failed authentication attempts lock the account for a defined period, and passwords, keys and other authentication secrets are stored and transmitted only in protected form.	5.2	8.3
User provisioning & deprovisioning Joiner/mover/leaver process to grant, change, and promptly remove access across systems, in which every person is issued an account of their own carrying a unique name or number, so an action in a log traces back to one named individual rather than to a shared or generic login. Each person’s right of access is recorded when it is established and reviewed on a schedule thereafter, as well as granted and changed - so what someone holds is a documented position that has been looked at again, not the accumulated residue of past requests - and what may be granted follows the organization’s access authorization rules rather than the judgement of whoever processes the request.	5.3, 6.1, 6.2	8.2
Data Protection & Privacy
Data retention & secure disposal Data is retained per policy and securely destroyed when no longer needed. The hardware and media that held it reach a defined final disposition at end of life, by a route the organization has decided in advance rather than by whatever happens to the box; and any media that stays in service is cleared of that data before it is reused, reassigned, or passed to anyone else.	3.5	3.2
Encryption in transit & at rest Strong cryptography protects sensitive data in transit over public networks and at rest in storage.	3.11	3.5, 4.2
Infrastructure & Operations
Asset inventory An inventory of hardware, software, and information assets with assigned owners, in which the movement of equipment and removable media into, out of, and within the organization’s premises is recorded against the person responsible for it.	1.1, 2.1	12.5
Logging & monitoring Security-relevant events - including successful and failed log-in attempts - are logged, protected, retained, and reviewed for anomalies, and the discrepancies that review finds are reported to the people who act on them. The review runs on a defined cadence and covers the records of system activity as a set - the audit logs, the reports of who accessed what, and the record of security incidents - rather than the log stream alone.	8.1, 8.2	10.2, 10.3, 10.4
Malware protection Anti-malware controls prevent, detect, and respond to malicious software on endpoints and servers, and detections are reported to the people who act on them. The mechanism is kept live rather than merely installed: signatures, definitions and detection engines update automatically as the vendor issues them rather than on someone remembering to apply them, what it detects and what it does about it is logged, and it runs where an ordinary user cannot switch it off, uninstall it or exclude their way around it - only a documented, authorized change may disable it, and then for a stated period.	10.1, 10.2	5.2, 5.3
Network security controls Firewalls/segmentation and network controls restrict traffic to and from sensitive environments.	4.4, 4.5, 12.2, 13.4	1.2, 1.3
Penetration testing programme A defined penetration-testing programme - who tests, what is in scope, on what schedule and to what rules of engagement - under which testers attempt real attacks against externally exposed systems and, separately, from inside the network; findings are prioritised by risk and remediated; and the fix is retested to confirm the security measure now works as intended.	18.1, 18.2, 18.3, 18.4, 18.5	11.4
Secure software development Secure coding, review, and testing practices across the development lifecycle.	16.1, 16.12	6.2
Vulnerability management Regular scanning, prioritization, and remediation of vulnerabilities across systems and applications, fed by current information about threats and weaknesses collected from outside the organization as well as from its own scans - vendor and industry security advisories for the software actually in use, and the threat feeds, bulletins and sector reporting that describe how systems like these are being attacked now - which is gathered continuously rather than at the next scan, evaluated for whether it applies here, and used to decide what is looked for and what is fixed first.	7.1, 7.3	6.3, 11.3
Resilience & Continuity
Incident response A documented, tested plan to detect, triage, contain, remediate, and communicate security incidents, and to mitigate - so far as is practicable - the harmful effect of a use or disclosure of personal data the organization knows breached its own policies or the law. Each incident is recorded together with its outcome - what happened, what was done about it and how it ended - as a record of that incident, which is a different artifact from the plan being documented. The mitigation duty runs to violations by the organization itself AND to violations by the processors, vendors and other parties handling that data on its behalf: the plan reaches an incident somebody else caused with the organization’s data, so learning of one triggers the same containment and remediation as an incident inside its own walls rather than a request that the other party deal with it. Where an incident carries a duty to tell someone outside the organization, the plan discharges it on the clock the applicable law sets rather than whenever the investigation happens to conclude: whether an incident is notifiable is decided against written criteria rather than argued after the fact, the regulator or supervisory authority is notified inside the deadline that regime states, the people whose data is affected are told where the risk to them warrants it, and where a deadline is missed the notification itself explains the delay instead of passing over it.	17.1, 17.4	12.10
Third-party Risk
Third-party / vendor risk management Due diligence, contractual safeguards, and ongoing monitoring of vendors that handle your data: the agreement obliges the vendor to comply in its own right with the security requirements that apply to it - an absolute standard, not a promise to match whatever you happen to do - to pass those obligations down to any subcontractor it brings in BY ENTERING INTO a contract or equivalent written arrangement with that subcontractor rather than by merely requiring equivalent practice of it, and to report to you, within a stated time, security incidents it becomes aware of and confirmed breaches of your data. Where a contract is not the instrument available, an equivalent written arrangement carrying the same obligations discharges the duty. The same obligations, together with the separation that keeps a related organization out of data it is not entitled to, are written into the governing document of any other arrangement that puts your data in the hands of a sponsor, parent, affiliate or plan. Diligence is not confined to security where the relationship warrants more: for suppliers significant enough to matter, the organization states the standards of conduct it expects of them - how they behave commercially and how they treat the environment around their operations - and screens candidates and incumbents against those stated expectations as part of the same selection and monitoring cycle, rather than accepting a signature on a code as evidence of it.	15.4, 15.5, 15.6	12.8
People & Culture
Security awareness training Ongoing security and data-handling awareness training for all personnel, with completion tracking, and periodic security updates - reminders, bulletins and alerts - issued to the workforce between training cycles. New joiners are trained within a defined period of starting, anyone whose work is affected is retrained within a defined period after a material change to the policies or procedures, and every completion is recorded.	14.1	12.6

Beyond the pair

Where else this work counts

A framework is lit when a shared control above also maps to it. Unlit means none of them do — an absence, not a judgment about that standard.

Also reached by these 16 controls

AI Governance Essentials
Amazon Appstore Child-Directed Apps
Apple App Store Kids Category
COPPA
ESG Essentials
EU AI Act
GDPR
Google Play Families
HIPAA
ISO 9001
ISO/IEC 27001
ISO/IEC 42001
NIST AI Risk Management Framework
NIST Cybersecurity Framework
NIST SP 800-171
NIST SP 800-53
SOC 2
SOX (Sarbanes-Oxley) Section 404
US Employment Law - Federal Baseline

Nearby pairs

The thesis

Why this is one project, not two

On a crosswalk-native model, PCI DSS mostly lights up controls you already built for CIS Critical Security Controls. You’re not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That’s the whole idea behind collect once, comply everywhere.

Next step

Add PCI DSS to the work you already did

Apply both frameworks in one workspace and see the overlap measured against the controls you already hold.

Start free with CIS Critical Security Controls + PCI DSS See all pairs