Crossbearing · standards comparison

PCI DSS to ISO/IEC 27001

What you can reuse, what to extend and what is new when you add ISO/IEC 27001 to PCI DSS.

Compare another pair

I already have I want to add

Two standards overlaid: reuse, extend or write new.

What carries over from PCI DSS to ISO/IEC 27001

Your PCI DSS controls cover a good part of Annex A’s technical ground, but only inside the cardholder data environment, and ISO/IEC 27001 needs what PCI DSS doesn’t ask for: a management system. Expect new work on the ISMS scope and context, an organisation-wide risk assessment and treatment, a Statement of Applicability, objectives, internal audit and management review — and on controls PCI DSS barely touches, such as business continuity, legal requirements and privacy.

Of the 118 clauses and controls ISO/IEC 27001 asks for: 54 to extend and 64 new.

54 Extend Keep what you have and add the new standard’s content.
64 New Nothing you have covers it: new work.

Clause and control numbers checked against PCI DSS and ISO/IEC 27001 themselves; descriptions are MajorCyber™’s own words. Mapping by MajorCyber™, last checked 27 October 2026. Going the other way? ISO/IEC 27001 to PCI DSS

Built on your device, with the documents you tick below. Nothing is uploaded.

Do I need to rewrite my policies?

No rewrite, but a re-frame. Your PCI DSS policies are a strong base for ISO/IEC 27001’s topic-specific policies, but they are written for the CDE. Widen them to the whole ISMS scope, and make sure the information security policy comes from top management, frames your security objectives, and commits to meeting requirements and to continual improvement.

The management system, clause by clause

ISO/IEC 27001 is a management-system standard with clauses 4 to 10; PCI DSS isn’t. Each row says what ISO/IEC 27001 asks for, and which parts of PCI DSS already support it.

ISO/IEC 27001 clauses 4 to 10 compared with PCI DSS
Clause	Your PCI DSS	ISO/IEC 27001 asks for	What to do
4.1 Context	Nothing here	Internal and external issues that affect what the ISMS is meant to achieve — including, since the 2024 amendment, whether climate change is relevant.	New PCI DSS has nothing like this. Analyse the internal and external issues that affect your security, beyond card data, including whether climate change is relevant.
4.2 Interested parties	Nothing here	Who has a stake in information security, what they require, and which of those requirements the ISMS will address.	New Your acquirer and the payment brands are already interested parties. Add the others — customers, regulators, staff, suppliers — and decide which of their requirements the ISMS will address.
4.3 Scope	12.5	The boundaries of the ISMS: which parts of the organisation, locations, assets and interfaces it covers.	Extend Your PCI DSS scope helps define the ISMS scope, but they are different things. Decide what the ISMS covers — perhaps far more than the CDE — and document its boundaries and interfaces.
4.4 The management system	Nothing here	An ISMS that is set up, run, maintained and continually improved, with its processes and how they interact.	New Nothing in PCI DSS corresponds: new work for the ISMS.
5.1 Leadership	12.4	Top management directs and supports the ISMS: aligned with strategy, built into the business, resourced and communicated.	New Executive responsibility for PCI DSS is a start. ISO/IEC 27001 wants top management to direct the whole ISMS: aligned with strategy, resourced, and built into the business.
5.2 Policy	12.1	An information security policy from top management that frames objectives and commits to meeting requirements and improving.	Extend Your security policy carries over. Make sure top management sets it, that it frames objectives, and that it commits to meeting requirements and to continual improvement.
5.3 Roles	12.1	Responsibilities and authorities for information security assigned and communicated.	Extend Your PCI DSS roles carry over. Add the responsibility for reporting on how the ISMS performs, and roles for the whole ISMS scope.
6.1.1 Risks and opportunities	Nothing here	Plan how the ISMS addresses the risks and opportunities that come from its context and interested parties.	New Nothing in PCI DSS corresponds: new work for the ISMS.
6.1.2 Risk assessment	12.3	A repeatable information security risk assessment: criteria for acceptance and assessment, risk owners, likelihood and consequence, prioritisation.	New Targeted risk analyses are inputs, not a risk assessment. ISO/IEC 27001 needs a repeatable process across the whole scope, with criteria for accepting risk, risk owners, and likelihood and consequence.
6.1.3 Risk treatment	Nothing here	Choose treatments and the controls they need, compare them with Annex A, write a Statement of Applicability (6.1.3 d) and a treatment plan approved by the risk owners.	New PCI DSS sets its controls for you, so there is no treatment choice to record. Choose controls for each risk, compare them with all 93 Annex A controls, and write a Statement of Applicability and a treatment plan.
6.2 Objectives	Nothing here	Measurable information security objectives, with plans for who achieves them, how and by when.	New PCI DSS has no security objectives. Set measurable ones for the ISMS, with plans for who achieves them and by when.
6.3 Planning changes	Nothing here	Changes to the management system are carried out in a planned way.	New Nothing in PCI DSS corresponds: new work for the ISMS.
7.1 Resources	Nothing here	The resources the management system needs are provided.	New Nothing in PCI DSS corresponds: new work for the ISMS.
7.2 Competence	6.2	People whose work affects information security are competent, with evidence kept.	New PCI DSS training for developers and incident responders helps. ISO/IEC 27001 wants competence defined for everyone whose work affects security, with evidence kept.
7.3 Awareness	12.6	People know the security policy, their part in the ISMS, and what failing to follow it means.	Extend Your awareness programme carries over. Make sure people know the security policy, how they contribute to the ISMS, and what not following it means.
7.4 Communication	Nothing here	What is communicated, when, to whom and how.	New Nothing in PCI DSS corresponds: new work for the ISMS.
7.5 Documented information	1.12.13.14.15.16.17.18.19.110.111.1	Documents and records the ISMS needs are created, updated and controlled.	Extend Your PCI DSS documentation carries over. Put it under the ISMS’s document control: approval, versions, distribution and retention.
8.1 Operational control	Nothing here	Processes planned, run and controlled, including outsourced ones, with evidence that they ran as planned.	New Nothing in PCI DSS corresponds: new work for the ISMS.
8.2 Risk assessment in operation	12.3	Risk assessments carried out at planned intervals and when significant changes happen.	New Targeted risk analyses help. Run the ISMS risk assessment at planned intervals and when significant changes happen, and keep the results.
8.3 Risk treatment in operation	Nothing here	The risk treatment plan implemented.	New Nothing in PCI DSS corresponds: new work for the ISMS.
9.1 Monitoring and measurement	Nothing here	What is monitored and measured, how and when, and how the results are evaluated.	New Nothing in PCI DSS corresponds: new work for the ISMS.
9.2 Internal audit	12.4	Internal audits at planned intervals, by objective auditors, against the standard and the organisation’s own requirements.	New Quarterly reviews by service providers help, but an annual PCI DSS assessment isn’t an internal audit. Set up an audit programme covering the whole ISMS, with objective auditors.
9.3 Management review	Nothing here	Top management reviews the ISMS at planned intervals, with set inputs and recorded decisions.	New PCI DSS has no management review. Have top management review the ISMS at planned intervals, with set inputs and recorded decisions.
10.1 Continual improvement	Nothing here	The ISMS keeps getting more suitable, adequate and effective.	New Nothing in PCI DSS corresponds: new work for the ISMS.
10.2 Nonconformity and corrective action	Nothing here	Nonconformities are corrected, their causes found and removed, and the actions checked.	New Nothing in PCI DSS corresponds: new work for the ISMS.

Controls: ISO/IEC 27001 Annex A, against PCI DSS v4.0.1 requirements

Each ISO/IEC 27001 Annex A control, with the PCI DSS requirements that support it. PCI DSS controls apply to the cardholder data environment: widen them to the ISMS scope.

ISO/IEC 27001 Annex A controls, with the PCI DSS v4.0.1 requirements controls that support each
ISO/IEC 27001 control	Supported by your PCI DSS	What to do
Organisational
5.1 Security policy set, approved and kept under review	12.1 Security policy known and current, with roles assigned Partly covers it 1.1 Network security policies, procedures and roles documented Partly covers it 2.1 Configuration policies, procedures and roles documented Partly covers it 3.1 Data protection policies, procedures and roles documented Partly covers it 4.1 Transmission policies, procedures and roles documented Partly covers it 5.1 Anti-malware policies, procedures and roles documented Partly covers it 6.1 Secure development policies, procedures and roles documented Partly covers it 7.1 Access control policies, procedures and roles documented Partly covers it 8.1 Authentication policies, procedures and roles documented Partly covers it 9.1 Physical security policies, procedures and roles documented Partly covers it 10.1 Logging policies, procedures and roles documented Partly covers it 11.1 Security testing policies, procedures and roles documented Partly covers it	Extend Your PCI DSS policies carry over. Widen them to the ISMS scope, and add the topic-specific policies your risks call for that PCI DSS doesn’t ask for.
5.2 Security roles and responsibilities assigned	12.1 Security policy known and current, with roles assigned Partly covers it 1.1 Network security policies, procedures and roles documented Partly covers it 2.1 Configuration policies, procedures and roles documented Partly covers it 3.1 Data protection policies, procedures and roles documented Partly covers it 4.1 Transmission policies, procedures and roles documented Partly covers it 5.1 Anti-malware policies, procedures and roles documented Partly covers it 6.1 Secure development policies, procedures and roles documented Partly covers it 7.1 Access control policies, procedures and roles documented Partly covers it 8.1 Authentication policies, procedures and roles documented Partly covers it 9.1 Physical security policies, procedures and roles documented Partly covers it 10.1 Logging policies, procedures and roles documented Partly covers it 11.1 Security testing policies, procedures and roles documented Partly covers it	Extend Your PCI DSS roles carry over. Extend them to every part of the ISMS scope.
5.3 Conflicting duties kept apart	6.5 Changes to system components managed securely Related	New Separating development and production duties helps. Look for other conflicting duties across the organisation.
5.4 Managers require staff to follow security policy	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
5.5 Contacts with the relevant authorities	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
5.6 Links with security forums and specialist groups	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
5.7 Threat intelligence gathered and used	6.3 Vulnerabilities found, ranked and patched Related	New Using industry sources for vulnerabilities helps. ISO/IEC 27001 wants threat intelligence gathered, analysed and used more widely.
5.8 Security built into projects	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
5.9 Inventory of information and assets, with owners	12.5 PCI DSS scope documented and confirmed Partly covers it 6.3 Vulnerabilities found, ranked and patched Related 12.3 Risks to the CDE identified, evaluated and managed Related	Extend Your inventory of in-scope components carries over. Widen it to all information and assets in the ISMS scope, with owners.
5.10 Rules for acceptable use of information and assets	12.2 Acceptable use rules for end-user technologies Partly covers it	Extend Your acceptable use rules carry over. Widen them to all information and assets, not only end-user technologies.
5.11 Assets handed back when people leave	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
5.12 Information classified by sensitivity	3.2 Account data kept to a minimum, with retention limits Related 3.3 Sensitive authentication data never kept after authorisation Related	New Card data handling helps. Set a classification scheme for all information, by confidentiality, integrity and availability needs.
5.13 Information labelled to match its classification	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
5.14 Rules for transferring information	4.2 Card numbers sent over public networks strongly encrypted Partly covers it 9.4 Media with card data stored, moved and destroyed securely Related	Extend Rules for card data in transit carry over. Write transfer rules for all information, electronic, physical and verbal.
5.15 Access control rules	7.2 Access defined by role, least privilege and reviewed Partly covers it 7.3 Access enforced through access control systems Related	Extend Your access rules carry over. Widen them to all information and systems in the ISMS scope.
5.16 Identities managed through their life cycle	8.2 User IDs and accounts managed through their life cycle Partly covers it	Extend Account management carries over. Apply it to every identity in the ISMS scope.
5.17 Passwords and other secrets managed	8.3 Strong authentication for users and administrators Partly covers it 8.6 System and application accounts and their secrets controlled Partly covers it	Extend Password and secret management carries over. Apply it across the ISMS scope.
5.18 Access rights granted, reviewed and removed	7.2 Access defined by role, least privilege and reviewed Partly covers it 8.2 User IDs and accounts managed through their life cycle Partly covers it	Extend Access reviews carry over. Apply them to all systems in the ISMS scope, on intervals your risk assessment sets.
5.19 Security in supplier relationships	12.8 Risks from third-party service providers managed Partly covers it	Extend Service provider management carries over. Apply it to every supplier that affects information security, not only those touching card data.
5.20 Security terms in supplier contracts	12.8 Risks from third-party service providers managed Partly covers it 12.9 Service providers support their customers’ compliance Related	Extend Written agreements carry over. Add security terms to every supplier contract that needs them.
5.21 Security across the ICT supply chain	12.8 Risks from third-party service providers managed Related	New Service provider checks help. Manage security risks across the ICT supply chain, including the products you buy.
5.22 Supplier services monitored and reviewed	12.8 Risks from third-party service providers managed Partly covers it	Extend Annual checks on service providers carry over. Monitor and review every relevant supplier’s security and service delivery.
5.23 Security for the cloud services you use	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
5.24 Incident management planned and prepared	12.10 Suspected and confirmed incidents responded to at once Partly covers it	Extend Your incident response plan carries over. Widen it to all incidents in the ISMS scope, not only those affecting card data.
5.25 Security events assessed and classified	12.10 Suspected and confirmed incidents responded to at once Partly covers it 10.7 Failures of critical security controls detected and handled Related	Extend Alert handling helps. Define how security events are assessed and when they become incidents.
5.26 Incidents responded to by procedure	12.10 Suspected and confirmed incidents responded to at once Partly covers it	Extend Your incident response carries over. Apply the documented procedures to every type of incident.
5.27 Lessons from incidents applied	12.10 Suspected and confirmed incidents responded to at once Related	New Updating the plan from lessons learned carries over. Use what incidents teach to strengthen controls across the ISMS.
5.28 Evidence collected and preserved	12.10 Suspected and confirmed incidents responded to at once Related	New Incident response helps. Set procedures for collecting and preserving evidence so it can be used in disciplinary or legal action.
5.29 Security kept up during disruption	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
5.30 ICT ready for business continuity	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
5.31 Legal, regulatory and contractual requirements identified	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
5.32 Intellectual property respected	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
5.33 Records protected	3.2 Account data kept to a minimum, with retention limits Related 10.3 Audit logs protected from change and deletion Related 10.5 Log history kept and available for analysis Related	New Log protection and retention help. Protect all records the organisation must keep, by legal, contractual and business need.
5.34 Privacy and personal data protected	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
5.35 Independent review of security	11.4 Internal and external penetration tests, findings fixed Related	New Independent penetration testing helps. ISO/IEC 27001 wants independent reviews of the whole approach to information security.
5.36 Compliance with security policies checked	12.4 Compliance with PCI DSS managed by the executive Partly covers it	Extend Managing PCI DSS compliance helps. Check compliance with all your security policies and standards regularly.
5.37 Operating procedures documented	1.1 Network security policies, procedures and roles documented Partly covers it 2.1 Configuration policies, procedures and roles documented Partly covers it 3.1 Data protection policies, procedures and roles documented Partly covers it 4.1 Transmission policies, procedures and roles documented Partly covers it 5.1 Anti-malware policies, procedures and roles documented Partly covers it 6.1 Secure development policies, procedures and roles documented Partly covers it 7.1 Access control policies, procedures and roles documented Partly covers it 8.1 Authentication policies, procedures and roles documented Partly covers it 9.1 Physical security policies, procedures and roles documented Partly covers it 10.1 Logging policies, procedures and roles documented Partly covers it 11.1 Security testing policies, procedures and roles documented Partly covers it	Extend Your PCI DSS procedures carry over. Document the operating procedures for the rest of the ISMS scope.
People
6.1 Background checks before people join	12.7 Staff screened before they join Partly covers it	Extend Screening carries over. Apply it to everyone joining, proportionate to the information they’ll access.
6.2 Security duties in terms of employment	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
6.3 Security awareness, education and training	12.6 Ongoing security awareness training Partly covers it 5.4 Users protected against phishing Related 9.5 Card-reading devices protected from tampering and swaps Related	Extend Your awareness training carries over. Widen it to everyone in the ISMS scope, with role-based training where needed.
6.4 Disciplinary process for policy breaches	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
6.5 Duties that continue after people leave or move	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
6.6 Confidentiality agreements	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
6.7 Remote working secured	1.5 Devices that reach both the internet and the CDE protected Partly covers it	Extend Controls on devices that reach the CDE help. Set security measures for all remote working.
6.8 Staff report security events	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
Physical
7.1 Secure perimeters	9.2 Entry to facilities and systems with card data controlled Partly covers it	Extend CDE physical security carries over. Define perimeters for all areas with information or systems in the ISMS scope.
7.2 Entry controls	9.2 Entry to facilities and systems with card data controlled Partly covers it 9.3 Staff and visitor access authorised and managed Partly covers it	Extend Entry controls and visitor logs carry over. Apply them to every secure area in the ISMS scope.
7.3 Offices, rooms and facilities secured	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
7.4 Premises monitored	9.2 Entry to facilities and systems with card data controlled Partly covers it	Extend Monitoring access to sensitive areas carries over. Widen premises monitoring to the ISMS scope.
7.5 Protection from physical and environmental threats	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
7.6 Rules for working in secure areas	9.3 Staff and visitor access authorised and managed Related	New Visitor escorting helps. Set rules for working in all secure areas.
7.7 Clear desks and locked screens	8.2 User IDs and accounts managed through their life cycle Related	New Re-authentication after 15 minutes idle helps. Set clear desk and clear screen rules for papers, media and unattended devices.
7.8 Equipment sited and protected	9.5 Card-reading devices protected from tampering and swaps Partly covers it	Extend Protecting card-reading devices helps. Site and protect all equipment in the ISMS scope.
7.9 Assets protected off site	9.5 Card-reading devices protected from tampering and swaps Related	New Inspecting devices helps. Protect all assets used off site.
7.10 Storage media handled securely	9.4 Media with card data stored, moved and destroyed securely Partly covers it	Extend Card data media handling carries over. Apply it to all storage media.
7.11 Power and other utilities protected	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
7.12 Cabling protected	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
7.13 Equipment maintained	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
7.14 Equipment wiped before disposal or reuse	9.4 Media with card data stored, moved and destroyed securely Partly covers it	Extend Secure destruction carries over. Wipe or destroy all equipment and media before disposal or reuse.
Technological
8.1 User devices protected	1.5 Devices that reach both the internet and the CDE protected Partly covers it	Extend Controls on devices that reach the CDE help. Protect every user endpoint in the ISMS scope.
8.2 Privileged access restricted	7.2 Access defined by role, least privilege and reviewed Partly covers it 8.4 Multi-factor authentication for access into the CDE Related 8.6 System and application accounts and their secrets controlled Related	Extend Controls on administrator and system accounts carry over. Restrict and manage privileged access everywhere.
8.3 Access to information restricted	7.3 Access enforced through access control systems Partly covers it 3.4 Full card numbers masked on screen, copying restricted Related 7.2 Access defined by role, least privilege and reviewed Related	Extend Need-to-know access carries over. Restrict access to all information in the ISMS scope.
8.4 Access to source code controlled	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
8.5 Secure authentication	8.3 Strong authentication for users and administrators Partly covers it 8.4 Multi-factor authentication for access into the CDE Partly covers it 8.5 MFA systems set up so they can’t be bypassed or misused Partly covers it	Extend MFA and strong passwords carry over. Set authentication by the sensitivity of each system.
8.6 Capacity managed	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
8.7 Malware protection	5.2 Malware prevented, or detected and dealt with Partly covers it 5.3 Anti-malware kept active, up to date and monitored Partly covers it 5.4 Users protected against phishing Partly covers it	Extend Anti-malware carries over. Apply it across the ISMS scope, with user awareness.
8.8 Technical vulnerabilities managed	6.3 Vulnerabilities found, ranked and patched Partly covers it 11.3 Internal and external vulnerability scans, findings fixed Partly covers it 11.4 Internal and external penetration tests, findings fixed Partly covers it 6.4 Public-facing web applications and payment pages protected Related	Extend Scanning, patching and penetration testing carry over. Apply them to all systems in scope, at intervals set by risk.
8.9 Configurations managed	1.2 Firewalls and other network controls configured and maintained Partly covers it 2.2 System components hardened, with vendor defaults changed Partly covers it 2.3 Wireless networks configured and managed securely Related	Extend Configuration standards carry over. Apply them to all hardware, software, services and networks in scope.
8.10 Information deleted when no longer needed	3.2 Account data kept to a minimum, with retention limits Partly covers it 3.3 Sensitive authentication data never kept after authorisation Related	Extend Deleting card data past its retention carries over. Delete all information once it is no longer needed.
8.11 Data masking	3.4 Full card numbers masked on screen, copying restricted Partly covers it 3.5 Stored card numbers made unreadable Related	Extend Masking card numbers carries over. Decide where else data masking is needed, such as personal data.
8.12 Data leakage prevented	3.4 Full card numbers masked on screen, copying restricted Partly covers it	Extend Stopping card numbers being copied helps. Apply data leakage prevention to all sensitive information.
8.13 Backups	9.4 Media with card data stored, moved and destroyed securely Related	New Securing backup media helps. Set a backup policy for information, software and systems, and test restores.
8.14 Redundancy for availability	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
8.15 Logging	10.2 Audit logs capture the events needed to spot and trace attacks Partly covers it 10.3 Audit logs protected from change and deletion Partly covers it 10.5 Log history kept and available for analysis Partly covers it 10.4 Audit logs reviewed for anomalies Related	Extend Your audit logging carries over. Apply it across the ISMS scope, with retention set by need.
8.16 Monitoring for anomalous behaviour	10.4 Audit logs reviewed for anomalies Partly covers it 10.7 Failures of critical security controls detected and handled Partly covers it 11.5 Intrusions and unexpected file changes detected Partly covers it 11.2 Wireless access points found and rogue ones dealt with Related 11.6 Unauthorised changes to payment pages detected Related	Extend Log review, intrusion detection and change detection carry over. Monitor networks, systems and applications across the ISMS scope.
8.17 Clocks synchronised	10.6 Clocks synchronised across systems Partly covers it	Extend Time synchronisation carries over. Apply it to all systems in scope.
8.18 Powerful utility programs restricted	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.
8.19 Software installation on live systems controlled	2.2 System components hardened, with vendor defaults changed Related 11.5 Intrusions and unexpected file changes detected Related	New Change detection helps. Control software installation on all operational systems.
8.20 Networks secured	1.2 Firewalls and other network controls configured and maintained Partly covers it 1.3 Traffic into and out of the CDE restricted Partly covers it 1.4 Connections between trusted and untrusted networks controlled Partly covers it 2.3 Wireless networks configured and managed securely Partly covers it 6.4 Public-facing web applications and payment pages protected Related 11.2 Wireless access points found and rogue ones dealt with Related	Extend Network security controls carry over. Apply them to all networks in scope.
8.21 Network services secured	1.4 Connections between trusted and untrusted networks controlled Related 4.2 Card numbers sent over public networks strongly encrypted Related	New Network controls carry over. Set security requirements for all network services, including those from providers.
8.22 Networks segregated	1.3 Traffic into and out of the CDE restricted Partly covers it 1.4 Connections between trusted and untrusted networks controlled Partly covers it	Extend Segmentation carries over. Segregate other groups of services, users and systems by risk.
8.23 Web filtering	5.4 Users protected against phishing Related	New Anti-phishing helps. Manage access to external websites to reduce exposure to malicious content.
8.24 Cryptography and key management	3.5 Stored card numbers made unreadable Partly covers it 3.6 Keys that protect stored card data secured Partly covers it 3.7 Key management across the whole key life cycle Partly covers it 4.2 Card numbers sent over public networks strongly encrypted Partly covers it 12.3 Risks to the CDE identified, evaluated and managed Related	Extend Cryptography and key management carry over. Set rules for using cryptography for all information, not only card data.
8.25 Secure development life cycle	6.2 Bespoke and custom software developed securely Partly covers it	Extend Your secure development practices carry over. Apply them to all software development in scope.
8.26 Security requirements for applications	6.4 Public-facing web applications and payment pages protected Partly covers it	Extend Protecting web applications carries over. Set security requirements for every application you develop or acquire.
8.27 Secure architecture and engineering principles	6.2 Bespoke and custom software developed securely Related	New Secure coding practices help. Set secure engineering principles for systems as a whole.
8.28 Secure coding	6.2 Bespoke and custom software developed securely Partly covers it	Extend Secure coding carries over. Apply it to all development.
8.29 Security testing before release	6.2 Bespoke and custom software developed securely Partly covers it 11.4 Internal and external penetration tests, findings fixed Related	Extend Code review and penetration testing help. Define security testing for every release.
8.30 Outsourced development overseen	6.2 Bespoke and custom software developed securely Related	New Secure development rules help. Direct, monitor and review all outsourced development.
8.31 Development, test and live environments kept apart	6.5 Changes to system components managed securely Partly covers it	Extend Separating test and live environments carries over. Apply it across all development.
8.32 Changes controlled	6.5 Changes to system components managed securely Partly covers it 1.2 Firewalls and other network controls configured and maintained Related 11.6 Unauthorised changes to payment pages detected Related	Extend Change control carries over. Apply it to all changes to systems in scope.
8.33 Test data protected	6.5 Changes to system components managed securely Partly covers it	Extend Keeping live card numbers out of testing helps. Protect all test data, including personal data.
8.34 Audit testing that protects live systems	No counterpart	New Nothing in PCI DSS v4.0.1 requirements corresponds: new work.

A route from PCI DSS to ISO/IEC 27001

01
Scope and context
- Decide the ISMS scope: the CDE alone, or the wider organisation
- Analyse context and interested parties beyond the payment brands
02
Leadership and policy
- An information security policy from top management
- Measurable security objectives, and ISMS roles
03
Risk
- Set an organisation-wide risk assessment method, criteria and risk owners
- Use your targeted risk analyses as inputs, then treat the risks
04
Statement of Applicability
- Go through all 93 Annex A controls, citing your PCI DSS controls where they apply
- Widen them to the ISMS scope and add the controls PCI DSS doesn’t cover
05
Run and check
- Operate the ISMS and keep its records
- Internal audit, management review and corrective action
06
Certification
- Choose an accredited certification body
- Plan the stage 1 and stage 2 audits

Certification and audits

ISO/IEC 27001 is certified by an accredited certification body: a stage 1 and a stage 2 audit, surveillance audits each year, and recertification every three years.
Your Report on Compliance or Self-Assessment Questionnaire shows controls working in the CDE, but auditors will look for the ISMS records: risk assessment, Statement of Applicability, internal audit and management review.

Common pitfalls

Scoping the ISMS to the CDE alone, then finding that customers expect the certificate to cover the services they buy.
Treating the PCI DSS requirements as a Statement of Applicability. The SoA must address all 93 Annex A controls, with a justification for each.
Expecting targeted risk analyses to serve as the risk assessment. ISO/IEC 27001 needs a repeatable assessment across the whole scope, with criteria and risk owners.
Forgetting the controls PCI DSS barely touches: business continuity (5.29, 5.30), legal and contractual requirements (5.31), intellectual property (5.32) and privacy (5.34).

PCI DSS and ISO/IEC 27001 at a glance

PCI DSS and ISO/IEC 27001 side by side
Fact	PCI DSS	ISO/IEC 27001
What it is	Industry standard	Certifiable standard
How it applies	Required by contract or programme rules	Voluntary, often required by customers
How you show it	Assessed under the scheme’s own rules	Certification by an accredited certification body
Where	International	International
Covers	Information security, Audit & assurance, Application security	Information security, Risk management, Audit & assurance
Issued or enforced by	PCI Security Standards Council (PCI SSC); compliance programmes enforced by payment brands and acquirers	ISO and IEC (joint technical committee ISO/IEC JTC 1/SC 27)
Current edition or status	PCI DSS v4.0.1 (June 2024) is the active version. Requirements that were future-dated in v4.0 became mandatory on 31 March 2025.	ISO/IEC 27001:2022, amended by ISO/IEC 27001:2022/Amd 1:2024 (climate change considerations). The 2013 edition's certification transition has ended.

Next steps on MajorCyber™

Sources

PCI DSS (standard overview) — PCI Security Standards Council
PCI SSC Document Library (PCI DSS v4.0.1) — PCI Security Standards Council
ISO/IEC 27001:2022 — Information security management systems — Requirements — International Organization for Standardization (ISO)

Open questions

We found no mapping between PCI DSS and ISO/IEC 27001 from the PCI SSC, so these links are MajorCyber™’s analysis, made at the level of PCI DSS’s 63 second-level requirements. The sub-requirements under each one can go further than the notes say: the standard itself is the authority.
The appendices (A1 for multi-tenant service providers, A2 for early TLS on POS POI terminals, A3 for designated entities) aren’t mapped here.

The whole comparison in one PDF, with the documents you ticked.

An educational comparison, researched and drafted with AI assistance. A mapping shows where work you have already done supports a requirement; it never means the requirement is met. Your certification body decides what conforms. No standard’s text is reproduced: buy the standards from ISO or your national standards body.