What
Independent audit of nist/pci-dss-filter.json — verify that each PCI-DSS v4.0 requirement correctly maps to the right NIST 800-53 controls.
Why
PCI-DSS is the most prescriptive of the four frameworks — specific technical requirements (TLS 1.2+, AES-256, etc.) that must map precisely to 800-53 controls. This filter was AI-generated and needs review by someone who knows PCI-DSS requirements.
What to audit
The file is nist/pci-dss-filter.json (~40 lines). For each mapping:
- Is the PCI-DSS requirement ID correct? (1.3.1, 3.4, 7.2.1, 8.4.2, etc.)
- Are the right 800-53 controls mapped?
- Are there PCI-DSS requirements missing from the filter?
- PCI-DSS v4.0 introduced new requirements — are they included?
How to contribute
- Read
nist/pci-dss-filter.json
- Cross-reference against PCI SSC's 800-53 mapping or PCI-DSS v4.0 documentation
- Open a PR with corrections, or comment with findings
- Test:
bin/comply-db init --framework pci-dss
Current state
20 PCI-DSS requirements → 16 unique 800-53 controls. Very likely incomplete — PCI-DSS v4.0 has ~200+ requirements.
Who should review
- QSAs (Qualified Security Assessors)
- PCI compliance engineers
- Payment processing engineers familiar with PCI-DSS v4.0
- Anyone who's completed a PCI-DSS SAQ or ROC
What
Independent audit of
nist/pci-dss-filter.json— verify that each PCI-DSS v4.0 requirement correctly maps to the right NIST 800-53 controls.Why
PCI-DSS is the most prescriptive of the four frameworks — specific technical requirements (TLS 1.2+, AES-256, etc.) that must map precisely to 800-53 controls. This filter was AI-generated and needs review by someone who knows PCI-DSS requirements.
What to audit
The file is
nist/pci-dss-filter.json(~40 lines). For each mapping:How to contribute
nist/pci-dss-filter.jsonbin/comply-db init --framework pci-dssCurrent state
20 PCI-DSS requirements → 16 unique 800-53 controls. Very likely incomplete — PCI-DSS v4.0 has ~200+ requirements.
Who should review