Skip to content
AUSEC
Esc
  • Home/
  • Services/services/
  • Penetration testing/services/penetration-testing/
  • Vulnerability assessment/services/vulnerability-assessment/
  • Security audit/services/security-audit/
  • Compliance consulting/services/compliance-consulting/
  • Incident response and digital forensics/services/digital-forensics/
  • Corporate training and workshops/services/corporate-training/
  • Audit methodology/methodology/
  • Security posture quiz/#quiz
  • Threat Lab: attack simulator/threat-lab/#simulator
  • Threat Lab: cyber kill chain/threat-lab/#kill-chain
  • Threat Lab: defence in depth/threat-lab/#defence
  • Threat Lab: spot the phish/threat-lab/#phish
  • Threat Lab: terminal/threat-lab/#terminal
  • Frameworks hub/frameworks/
  • Framework cross-mapping/frameworks/#crossmap
  • PCI DSS v4.0.1/frameworks/pci-dss/
  • ISO/IEC 27001:2022/frameworks/iso-27001/
  • ISO/IEC 27002:2022/frameworks/iso-27002/
  • NIST Cybersecurity Framework 2.0/frameworks/nist-csf/
  • CERT-In Audit Guidelines (India)/frameworks/cert-in/
  • Training and internships/training/
  • Resources: articles and checklists/resources/
  • PCI DSS v4.0.1: what changed, and what it means now/resources/pci-dss-4-0-1-changes/
  • ISO/IEC 27001:2022 Annex A for beginners/resources/iso-27001-annex-a-beginners/
  • NIST CSF 2.0: the Govern function explained/resources/nist-csf-govern-function/
  • How to prepare for a CERT-In audit/resources/prepare-cert-in-audit/
  • Glossary/resources/#glossary
  • Team and certifications/team/
  • About Ausec/about/
  • Contact and book an assessment/contact/
  • Privacy policy/privacy/
  • Terms of use/terms/
  • Responsible disclosure/responsible-disclosure/
  • Design system/styleguide/

One control set, many obligations

Most organisations answer to more than one standard. Understand each framework, then see where they overlap so you can build controls once and evidence them many times.

Frameworks we work with

  • PCI DSS

    PCI DSS v4.0.1

    The security baseline for anyone who stores, processes or transmits payment card data.

    Current version
    v4.0.1
    Requirements
    12

  • ISO 27001

    ISO/IEC 27001:2022

    The international standard for an Information Security Management System (ISMS).

    Annex A controls
    93
    Themes
    4

  • ISO 27002

    ISO/IEC 27002:2022

    Implementation guidance for the 93 information security controls.

    Controls
    93
    Themes
    4

  • NIST CSF 2.0

    NIST Cybersecurity Framework 2.0

    A voluntary, risk-based framework for managing cybersecurity, now with Govern at the centre.

    Published
    Feb 2024
    Functions
    6

  • CERT-In

    CERT-In Audit Guidelines (India)

    India's national requirements for cyber security audits and incident reporting.

    Audit guidelines
    Jul 2025
    Incident reporting
    6 hours

How the frameworks relate

Indicative mapping for orientation only. Requirements are not equivalent one-to-one; confirm scope against each standard.

Indicative mapping between PCI DSS v4.0.1, ISO/IEC 27001:2022 Annex A and NIST CSF 2.0
Control topicPCI DSS v4.0.1ISO/IEC 27001:2022NIST CSF 2.0
Asset inventory12.5.15.9ID.AM
Network security controlsReq 18.20, 8.22PR.IR
Secure configurationReq 28.9PR.PS
Protecting stored dataReq 38.24, 5.33PR.DS
Encryption in transitReq 48.24, 5.14PR.DS
Malware protectionReq 58.7PR.PS, DE.CM
Secure development and patchingReq 68.8, 8.25 to 8.28PR.PS, ID.RA
Need-to-know accessReq 75.15, 5.18, 8.3PR.AA
Identification and authenticationReq 85.16, 5.17, 8.5PR.AA
Physical accessReq 97.1 to 7.4PR.AA
Logging and monitoringReq 108.15 to 8.17DE.CM
Security testingReq 118.8, 8.29ID.RA, DE.CM
Policy and governanceReq 12Clause 5, 5.1, 5.2GV.PO, GV.RR
Risk assessment12.3Clause 6.1, 8.2ID.RA, GV.RM
Third-party risk12.85.19 to 5.22GV.SC
Security awareness12.66.3PR.AT
Incident response12.105.24 to 5.28RS.MA, RS.AN, RC.RP

Indicative mapping