PCI SSF
What is PCI SSF?
PCI Software Security Framework. It comprises 76 controls organised across 4 domains, published by PCI Security Standards Council, and applies in International.
How PCI SSF maps to other frameworks
All 76 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 4 domains PCI SSF groups its controls into
Frameworks that share controls with PCI SSF
Each of these has at least one control mapped to a control in PCI SSF. The number is how many PCI SSF controls are shared, counted from the mapping graph.
PSD2 SCA
16 shared controlsSOC for Cybersecurity - Cybersecurity Risk Management Examination
11 shared controlsSSAE 18 - Attestation Standards (SOC Reporting)
10 shared controlsSecurity of Critical Infrastructure Act 2018 (SOCI)
9 shared controlsTISAX - Trusted Information Security Assessment Exchange
9 shared controlsNIST Privacy Framework
8 shared controlsSOC 2
7 shared controlsUK AI Regulation Framework
6 shared controlsImplementation guides for frameworks that overlap PCI SSF
Training on frameworks that overlap PCI SSF
There is no course on PCI SSF itself. These cover frameworks that share controls with it, so the material carries across even though the standard named is different.
Where PCI SSF overlaps with the standards you already hold
What an auditor will ask you for
All 49 PCI SSF controls, each with what it requires, the artefacts an auditor will ask you for, and where it commonly fails. Free to read, nothing to fill in.
Read the PCI SSF evidence request listWhat PCI SSF means in your sector
What PCI SSF means for your job
Questions people ask about PCI SSF
What is PCI SSF?
How many controls does PCI SSF have?
Where does PCI SSF apply?
What frameworks does PCI SSF map to?
How do I get started with PCI SSF compliance?
Query PCI SSF programmatically
PCI SSF, its 76 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
PCI SSF API reference and MCP config →How ready are you for PCI SSF?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.