Safeguard Docs
Frameworks and Connectors

PCI DSS and connectors

Which connectors provide evidence for PCI DSS, for which controls, and how to connect them.

Safeguard's automated tests map to 47 controls of PCI DSS v4.0. 658 tests apply: 626 read a connected system, and 32 read Safeguard's own records (policies, people, training and devices), so they need no connector. A passing result is evidence toward a control, not proof that the control is met on its own.

In the framework library: PCI DSS v4.0, with what a scan checks, the controls and the policy templates.

How to connect for this framework

  1. Connect the systems you run from the table below. Each connector links to its setup steps.
  2. Open the framework on Compliance › Frameworks, then its Connectors tab: it lists the connectors that answer this framework's tests, which of them you have connected, and whether each connection is healthy.
  3. Tests run on their schedule, or straight away with Run now on Compliance › Tests. A passing test counts toward its controls once its preview period has ended.

Automated tests are switched on per workspace by the Safeguard team.

Connectors with automated evidence (343)

ConnectorControls it provides evidence forTests
Microsoft Azure (also Microsoft Entra ID, Azure Government)1.3.1, 10.2.1, 10.3.2, 10.4.1, 10.5.1, 11.3.1, 11.5.1, 11.5.2, 2.2.1, 3.5.1, 3.7.4, 4.2.1, 5.2.1, 6.3.3, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.4.1, 8.4.2, 8.6.3127
Amazon Web Services (also AWS GovCloud, AWS CodeCommit, AWS Inspector, Amazon CloudWatch, Amazon S3, AWS Security Hub)1.3.1, 10.2.1, 10.3.2, 10.5.1, 11.3.1, 11.5.1, 11.5.2, 3.5.1, 3.7.4, 4.2.1, 6.3.1, 6.3.3, 6.4.2, 6.5.1, 7.2.1, 7.2.2, 8.2.6, 8.3.6, 8.4.1, 8.4.2, 8.6.381
Google Cloud Platform1.3.1, 10.2.1, 10.3.2, 10.4.1, 10.5.1, 11.3.1, 11.5.2, 2.2.1, 3.5.1, 3.7.4, 4.2.1, 6.3.3, 6.5.1, 7.2.1, 7.2.2, 8.2.6, 8.4.2, 8.6.3100
Google Workspace (also Google Cloud Identity, Google SSO)1.5.1, 10.4.1, 12.5.1, 3.5.1, 5.2.1, 5.4.1, 6.3.3, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.1, 8.4.222
Oracle Cloud (also Oracle Cloud Government)1.3.1, 10.2.1, 10.4.1, 10.5.1, 11.3.1, 11.5.1, 2.2.1, 3.5.1, 3.7.4, 4.2.1, 7.2.1, 7.2.2, 8.2.1, 8.2.6, 8.3.6, 8.4.2, 8.6.356
GitHub (also GitHub Enterprise, GitHub Issues)10.5.1, 12.10.1, 12.10.6, 6.2.4, 6.3.1, 6.3.2, 6.3.3, 6.5.1, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.4.2, 8.6.342
GitLab (also GitLab Issues, GitLab Self-Managed)10.5.1, 12.10.1, 12.10.6, 6.2.4, 6.3.1, 6.3.2, 6.3.3, 6.5.1, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.338
JumpCloud (also JumpCloud MDM, JumpCloud SSO)1.5.1, 12.5.1, 3.5.1, 5.2.1, 6.3.3, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.2, 8.6.315
Auth0 (also Auth0 SSO)10.5.1, 11.5.1, 7.2.2, 7.2.4, 8.2.1, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.1, 8.4.212
Azure DevOps12.10.1, 12.10.6, 6.2.4, 6.3.1, 6.3.2, 6.3.3, 6.5.1, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.6.325
Okta (also Okta SSO)10.5.1, 11.5.1, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.1, 8.4.2, 8.6.314
OVHcloud1.3.1, 10.2.1, 10.5.1, 11.3.1, 3.5.1, 3.7.4, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.321
Hetzner1.3.1, 10.2.1, 10.5.1, 11.3.1, 3.5.1, 3.7.4, 4.2.1, 7.2.1, 7.2.2, 8.4.2, 8.6.313
Alibaba Cloud1.3.1, 10.2.1, 3.5.1, 3.7.4, 4.2.1, 7.2.2, 8.3.6, 8.4.2, 8.6.319
Bitbucket6.2.4, 6.3.1, 6.3.2, 6.5.1, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.218
Cloudflare10.2.1, 4.2.1, 5.4.1, 6.4.2, 7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.313
IBM Cloud1.3.1, 10.2.1, 3.7.4, 7.2.2, 7.2.4, 8.2.5, 8.2.8, 8.4.2, 8.6.317
Keycloak10.5.1, 7.2.2, 7.2.4, 8.2.5, 8.2.8, 8.3.4, 8.3.6, 8.4.27
Kubernetes (also Gatekeeper OPA, Kyverno)1.3.1, 10.2.1, 2.2.1, 3.5.1, 4.2.1, 6.5.1, 7.2.2, 8.6.348
OneLogin (also OneLogin SSO)7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.27
CrowdStrike Falcon12.10.1, 5.2.1, 5.3.1, 5.3.5, 6.3.3, 7.2.4, 8.2.515
Datadog (also Datadog CSM)10.4.1, 10.5.1, 11.3.1, 2.2.1, 6.3.3, 7.2.4, 8.2.510
MongoDB Atlas1.3.1, 10.2.1, 3.5.1, 7.2.2, 7.2.4, 8.2.5, 8.4.27
PingOne (also Ping Identity)7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.3.4, 8.3.6, 8.4.26
ServiceNow12.10.1, 12.10.6, 6.3.3, 6.5.1, 7.2.2, 7.2.4, 8.2.59
Akamai4.2.1, 6.4.2, 7.2.2, 7.2.4, 8.2.5, 8.4.26
Asana12.10.1, 12.10.6, 6.3.3, 7.2.2, 7.2.4, 8.2.58
Claude (Anthropic)10.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.37
ClickUp12.10.1, 12.10.6, 6.3.3, 7.2.2, 7.2.4, 8.2.58
ElevenLabs10.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.36
Fireworks AI10.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.38
Heroku4.2.1, 6.3.3, 7.2.2, 7.2.4, 8.2.5, 8.4.27
Infisical10.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.38
Jira12.10.1, 12.10.6, 6.3.3, 7.2.1, 7.2.4, 8.2.59
Linear12.10.1, 12.10.6, 6.3.3, 7.2.1, 7.2.4, 8.2.59
Microsoft Intune1.5.1, 12.5.1, 3.5.1, 5.2.1, 6.3.3, 8.2.88
Mistral AI10.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.37
Monday.com12.10.1, 12.10.6, 6.3.3, 7.2.2, 7.2.4, 8.2.58
OpenAI API Platform10.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.38
Redis Cloud1.3.1, 4.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.26
SentinelOne12.10.1, 5.2.1, 5.3.1, 5.3.5, 7.2.4, 8.2.58
Shortcut12.10.1, 12.10.6, 6.3.3, 7.2.2, 7.2.4, 8.2.58
SigNoz10.4.1, 10.5.1, 7.2.2, 7.2.4, 8.2.5, 8.6.37
SolarWinds Service Desk12.10.1, 12.10.6, 6.3.3, 7.2.2, 7.2.4, 8.2.58
Sophos Intercept X12.10.1, 5.2.1, 5.3.1, 5.3.5, 7.2.4, 8.2.59
StackRox (also Red Hat Advanced Cluster Security)10.4.1, 11.3.1, 2.2.1, 6.3.3, 7.2.2, 8.6.39
Sumo Logic10.4.1, 10.5.1, 7.2.2, 7.2.4, 8.2.5, 8.4.26
Supabase1.3.1, 4.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.26
YouTrack12.10.1, 12.10.6, 6.3.3, 7.2.2, 7.2.4, 8.2.58
Authentik7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.4.25
ChatGPT10.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.25
Codeberg6.5.1, 7.2.1, 7.2.2, 7.2.4, 8.2.56
Duo Security7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.4.26
Elastic Observability10.4.1, 10.5.1, 7.2.2, 7.2.4, 8.2.55
Fastly4.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.25
Fleet1.5.1, 12.5.1, 3.5.1, 6.3.3, 8.2.87
Gitea6.5.1, 7.2.1, 7.2.2, 7.2.4, 8.2.56
Grafana10.4.1, 7.2.2, 7.2.4, 8.2.5, 8.6.35
Hugging Face7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.37
Jamf1.5.1, 12.5.1, 3.5.1, 6.3.3, 8.2.87
Kandji1.5.1, 12.5.1, 3.5.1, 6.3.3, 8.2.87
Kolide1.5.1, 12.5.1, 3.5.1, 6.3.3, 8.2.87
Linode1.3.1, 7.2.2, 7.2.4, 8.2.5, 8.4.25
LogicMonitor10.4.1, 12.10.1, 7.2.2, 7.2.4, 8.2.55
Logz.io10.4.1, 10.5.1, 7.2.2, 7.2.4, 8.2.55
Microsoft Defender for Endpoint12.10.1, 5.2.1, 5.3.1, 5.3.5, 6.3.312
Mosyle1.5.1, 12.5.1, 3.5.1, 6.3.3, 8.2.88
OpenRouter7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.36
Oracle Identity7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.4.25
PlanetScale6.5.1, 7.2.2, 7.2.4, 8.2.5, 8.4.25
Scaleway1.3.1, 7.2.4, 8.2.5, 8.4.2, 8.6.35
Sentry3.5.1, 7.2.2, 7.2.4, 8.2.5, 8.4.25
SimpleMDM1.5.1, 12.5.1, 3.5.1, 6.3.3, 8.2.85
Snowflake1.3.1, 7.2.2, 7.2.4, 8.2.5, 8.4.25
Splunk10.4.1, 10.5.1, 7.2.2, 7.2.4, 8.2.55
Terraform Cloud6.5.1, 7.2.2, 7.2.4, 8.2.5, 8.4.25
Airtable7.2.2, 7.2.4, 8.2.5, 8.4.24
Cisco Meraki SM12.5.1, 3.5.1, 6.3.3, 8.2.86
Cisco Secure Endpoint12.10.1, 5.2.1, 5.3.1, 6.3.36
ClickHouse1.3.1, 7.2.2, 7.2.4, 8.2.54
Cobalt11.3.1, 11.4.2, 11.4.3, 6.3.33
Docker7.2.1, 7.2.2, 7.2.4, 8.2.54
env06.5.1, 7.2.2, 7.2.4, 8.2.54
Fly.io7.2.2, 7.2.4, 8.2.5, 8.4.24
FusionAuth7.2.4, 8.2.5, 8.2.6, 8.4.24
Gerrit6.5.1, 7.2.2, 7.2.4, 8.2.55
Huntress12.10.1, 5.2.1, 5.3.1, 5.3.56
IBM Verify7.2.2, 7.2.4, 8.2.5, 8.4.24
Ivanti Neurons12.5.1, 3.5.1, 6.3.3, 8.2.86
Logto7.2.2, 8.3.4, 8.3.6, 8.4.24
Looker7.2.2, 7.2.4, 8.2.5, 8.4.24
Mailgun7.2.2, 7.2.4, 8.2.5, 8.4.24
Make7.2.2, 7.2.4, 8.2.5, 8.4.24
Mattermost7.2.2, 7.2.4, 8.2.5, 8.4.24
Miradore12.5.1, 3.5.1, 6.3.3, 8.2.86
New Relic10.4.1, 10.5.1, 7.2.4, 8.2.54
Nextcloud7.2.2, 7.2.4, 8.2.5, 8.4.24
OpenStack1.3.1, 12.10.1, 7.2.1, 7.2.24
ownCloud7.2.2, 7.2.4, 8.2.5, 8.4.24
Platform.sh7.2.2, 7.2.4, 8.2.5, 8.4.24
Pulumi (also Pulumi Cloud)2.2.1, 7.2.2, 7.2.4, 8.2.54
Railway7.2.2, 7.2.4, 8.2.5, 8.4.24
Redmine12.10.1, 12.10.6, 6.3.3, 8.2.55
Render7.2.2, 7.2.4, 8.2.5, 8.4.24
Rollbar10.4.1, 7.2.2, 7.2.4, 8.2.54
Salesforce7.2.2, 7.2.4, 8.2.5, 8.4.24
Site24x710.4.1, 7.2.2, 7.2.4, 8.2.54
Slack7.2.2, 7.2.4, 8.2.5, 8.4.24
Vercel7.2.2, 7.2.4, 8.2.5, 8.4.24
VMware10.2.1, 12.10.1, 2.2.1, 8.2.66
VMware Workspace ONE12.5.1, 3.5.1, 6.3.3, 8.2.86
Vultr1.3.1, 7.2.2, 7.2.4, 8.2.54
xAI10.2.1, 7.2.4, 8.4.2, 8.6.34
Zabbix10.4.1, 7.2.2, 7.2.4, 8.2.54
Zendesk7.2.2, 7.2.4, 8.2.5, 8.4.24
Zitadel7.2.2, 7.2.4, 8.2.5, 8.4.24
Zoom7.2.2, 7.2.4, 8.2.5, 8.4.24
ActiveCampaign7.2.2, 7.2.4, 8.2.53
Adobe Acrobat Sign7.2.2, 7.2.4, 8.2.53
Aha!7.2.2, 7.2.4, 8.2.53
Airbyte7.2.2, 7.2.4, 8.2.53
Ansible7.2.2, 7.2.4, 8.2.53
Aptible7.2.2, 7.2.4, 8.2.53
Ashby7.2.2, 7.2.4, 8.2.53
Assembla7.2.2, 7.2.4, 8.2.53
Attio7.2.2, 7.2.4, 8.2.53
Basecamp7.2.2, 7.2.4, 8.2.53
Beanstalk7.2.2, 7.2.4, 8.2.53
Better Stack10.4.1, 10.5.1, 12.10.13
Bitdefender GravityZone12.10.1, 5.2.1, 5.3.15
BoldSign7.2.2, 7.2.4, 8.2.53
Box7.2.2, 7.2.4, 8.2.53
Census7.2.2, 7.2.4, 8.2.53
Check Point CloudGuard11.3.1, 2.2.1, 6.3.33
Citrix ShareFile7.2.2, 7.2.4, 8.2.53
Close7.2.2, 7.2.4, 8.2.53
Cloudflare Access7.2.4, 8.2.5, 8.4.23
Coralogix10.4.1, 7.2.4, 8.2.53
Cortex XDR12.10.1, 5.2.1, 5.3.15
Coupa7.2.2, 7.2.4, 8.2.53
CrowdStrike Falcon Cloud11.3.1, 2.2.1, 6.3.33
Cybereason12.10.1, 5.2.1, 5.3.15
Databricks7.2.2, 7.2.4, 8.2.53
Deep Instinct12.10.1, 5.2.1, 5.3.14
Dialpad7.2.2, 7.2.4, 8.2.53
DigitalOcean1.3.1, 4.2.1, 6.3.36
DocuSign7.2.2, 7.2.4, 8.2.53
Dropbox7.2.2, 7.2.4, 8.2.53
Dropbox Sign7.2.2, 7.2.4, 8.2.53
Dynatrace10.4.1, 7.2.4, 8.2.53
Egnyte7.2.2, 7.2.4, 8.2.53
Elastic Security12.10.1, 5.2.1, 5.3.15
ESET Protect12.10.1, 5.2.1, 5.3.14
Figma7.2.2, 7.2.4, 8.2.53
Fivetran7.2.2, 7.2.4, 8.2.53
Fortinet FortiEDR12.10.1, 5.2.1, 5.3.15
Freshdesk7.2.2, 7.2.4, 8.2.53
Freshservice12.10.1, 6.3.3, 8.2.54
Front7.2.2, 7.2.4, 8.2.53
GoDaddy5.4.1, 7.2.4, 8.4.23
GoHighLevel7.2.2, 7.2.4, 8.2.53
GoTo Connect7.2.2, 7.2.4, 8.2.53
Greenhouse7.2.2, 7.2.4, 8.2.53
Hevo Data7.2.2, 7.2.4, 8.2.53
HubSpot7.2.2, 7.2.4, 8.2.53
Insightly7.2.2, 7.2.4, 8.2.53
Instana10.4.1, 7.2.4, 8.2.53
Jamf Protect12.10.1, 5.2.1, 5.3.14
Jira Service Management12.10.1, 12.10.6, 6.5.13
Kaspersky Endpoint12.10.1, 5.2.1, 5.3.15
Keap7.2.2, 7.2.4, 8.2.53
Lever7.2.2, 7.2.4, 8.2.53
Loopio7.2.2, 7.2.4, 8.2.53
ManageEngine12.5.1, 3.5.1, 6.3.35
Microsoft Dynamics 3657.2.2, 7.2.4, 8.2.53
n8n7.2.2, 7.2.4, 8.2.53
Netlify7.2.2, 7.2.4, 8.2.53
NinjaOne12.5.1, 3.5.1, 6.3.35
Nutshell7.2.2, 7.2.4, 8.2.53
OpenPhone7.2.2, 7.2.4, 8.2.53
Opsgenie Alerts12.10.1, 7.2.4, 8.2.55
PagerDuty12.10.1, 7.2.4, 8.2.56
PandaDoc7.2.2, 7.2.4, 8.2.53
Pipedrive7.2.2, 7.2.4, 8.2.53
Productboard7.2.2, 7.2.4, 8.2.53
Proxmox12.10.1, 7.2.2, 8.4.23
Qovery7.2.2, 7.2.4, 8.2.53
Ramp7.2.2, 7.2.4, 8.2.53
Rancher7.2.1, 7.2.2, 8.2.53
Red Canary12.10.1, 5.2.1, 5.3.14
Red Hat OpenShift10.2.1, 2.2.1, 7.2.25
RingCentral7.2.2, 7.2.4, 8.2.53
Rocket.Chat7.2.2, 7.2.4, 8.2.53
Segment7.2.2, 7.2.4, 8.2.53
SendGrid7.2.2, 7.2.4, 8.2.53
SignRequest7.2.2, 7.2.4, 8.2.53
Smartsheet7.2.2, 7.2.4, 8.2.53
Spacelift6.5.1, 7.2.4, 8.2.53
Spaceship5.4.1, 7.2.4, 8.4.23
SugarCRM7.2.2, 7.2.4, 8.2.53
Symantec Endpoint12.10.1, 5.2.1, 5.3.15
Tanium12.10.1, 5.2.1, 5.3.14
Teamwork7.2.2, 7.2.4, 8.2.53
Tines7.2.2, 7.2.4, 8.2.53
Trellix12.10.1, 5.2.1, 5.3.14
Trello7.2.2, 7.2.4, 8.2.53
Trend Micro Apex One12.10.1, 5.2.1, 5.3.15
UpCloud1.3.1, 7.2.4, 8.2.53
VMware Carbon Black12.10.1, 5.2.1, 5.3.15
Vtiger7.2.2, 7.2.4, 8.2.53
Webex7.2.2, 7.2.4, 8.2.53
WithSecure12.10.1, 5.2.1, 5.3.15
Workable7.2.2, 7.2.4, 8.2.53
Workato7.2.2, 7.2.4, 8.2.53
Wrike7.2.2, 7.2.4, 8.2.53
Yousign7.2.2, 7.2.4, 8.2.53
Zendesk Sell7.2.2, 7.2.4, 8.2.53
Zoho CRM7.2.2, 7.2.4, 8.2.53
Zoho Desk7.2.2, 7.2.4, 8.2.53
15Five7.2.4, 8.2.52
1Password7.2.4, 8.2.52
Action112.5.1, 6.3.32
Aikido Security11.3.1, 6.3.34
Aircall7.2.4, 8.2.52
Amplitude7.2.4, 8.2.52
Anchore11.3.1, 6.3.34
Apollo IO7.2.4, 8.2.52
Automox12.5.1, 6.3.34
Backblaze1.3.1, 3.5.12
Baramundi12.5.1, 6.3.34
Beyond Identity7.2.4, 8.2.52
BitSight11.3.1, 6.3.32
Brex7.2.4, 8.2.52
Bright Security11.3.1, 6.3.34
Bugcrowd11.3.1, 6.3.32
Burp Suite11.3.1, 6.3.33
Canva7.2.4, 8.2.52
Capsule7.2.4, 8.2.52
Check Point Harmony5.2.1, 5.3.12
Checkmarx11.3.1, 6.3.34
Citrix Endpoint Management12.5.1, 6.3.34
Confluence7.2.4, 8.2.52
Contrast Security11.3.1, 6.3.34
Copper7.2.4, 8.2.52
Culture Amp7.2.4, 8.2.52
dbt Cloud7.2.4, 8.2.52
Dependency-Track11.3.1, 6.3.34
Detectify11.3.1, 6.3.33
Endor Labs11.3.1, 6.3.34
Escape11.3.1, 6.3.34
Esper12.5.1, 6.3.32
folk7.2.4, 8.2.52
ForgeRock7.2.4, 8.2.52
GitGuardian11.3.1, 6.3.33
HackerOne11.3.1, 6.3.32
HashiCorp Consul2.2.1, 4.2.12
HashiCorp Nomad2.2.1, 4.2.12
HashiCorp Vault10.2.1, 8.4.22
Hexnode12.5.1, 6.3.34
Hightouch7.2.4, 8.2.52
Hive7.2.4, 8.2.52
Intercom7.2.4, 8.2.52
Intruder11.3.1, 6.3.34
Invicti11.3.1, 6.3.34
Ironclad7.2.4, 8.2.52
JFrog Xray11.3.1, 6.3.33
Lacework11.3.1, 6.3.33
Lattice7.2.4, 8.2.52
Launchpad7.2.4, 8.2.52
Malwarebytes5.2.1, 5.3.13
Mend11.3.1, 6.3.33
MinIO1.3.1, 3.5.12
Miro7.2.4, 8.2.52
Mixpanel7.2.4, 8.2.52
Northflank7.2.4, 8.2.52
Notion7.2.4, 8.2.52
Nucleus Security11.3.1, 6.3.34
Nutanix12.10.1, 7.2.22
Oneflow7.2.4, 8.2.52
OneSpan Sign7.2.4, 8.2.52
OneTrust Vendorpedia7.2.4, 8.2.52
Opal7.2.4, 8.2.52
Ox Security11.3.1, 6.3.34
Pingdom7.2.4, 8.2.52
Portainer7.2.1, 7.2.22
Prey12.5.1, 6.3.32
Prisma Cloud11.3.1, 6.3.33
Probely11.3.1, 6.3.34
Proofpoint Security Awareness12.6.1, 12.6.3.12
Prowler2.2.1, 6.3.32
Qualys11.3.1, 6.3.34
Qualys EDR12.10.1, 5.2.13
Rapid7 InsightVM11.3.1, 6.3.34
Riot12.6.1, 12.6.3.12
SailPoint7.2.4, 8.2.53
Salesflare7.2.4, 8.2.52
SecurityScorecard Atlas11.3.1, 6.3.31
Semgrep11.3.1, 6.3.34
Shuffle7.2.1, 8.2.52
SignNow7.2.4, 8.2.52
Snyk11.3.1, 6.3.34
Socket11.3.1, 6.3.33
SonarQube11.3.1, 6.3.34
StackHawk11.3.1, 6.3.33
Streak7.2.4, 8.2.52
Telnyx7.2.4, 8.2.52
Tenable11.3.1, 6.3.34
ThreatConnect7.2.1, 8.2.52
Torii7.2.4, 8.2.52
Tray.io7.2.4, 8.2.52
Trend Micro Cloud One2.2.1, 6.3.33
UpGuard Vendor Risk11.3.1, 6.3.32
Veracode11.3.1, 6.3.34
Webroot5.2.1, 5.3.12
Wiz11.3.1, 6.3.33
360Learning12.6.11
42Gears12.5.11
AppDynamics10.4.11
Chronosphere10.4.11
Civo1.3.12
Cortex XSOAR12.10.12
Cronitor10.4.11
D3 Security12.10.12
Docebo12.6.11
Firebase7.2.11
Google Chronicle SOAR12.10.12
Gusto7.2.41
IBM QRadar SOAR12.10.12
Immersive Labs6.2.21
Lessonly12.6.11
Prometheus10.4.11
Rapid7 InsightIDR12.10.12
Setyl12.5.11
Splunk SOAR12.10.12
TalentLMS12.6.11
Torq12.10.12
Turbot2.2.11
Udemy Business12.6.11
Uptime Robot10.4.11
Veza7.2.41
VictoriaMetrics10.4.11
Wasabi1.3.11
Yardstik12.7.11

Evidence by attestation (94)

These systems publish no API for what the tests check. Connect them to record the connection, then attest the result; an accepted attestation counts toward the control.

ConnectorControls
8x87.2.4
Acunetix11.3.1, 6.3.3
Addigy12.5.1
Affinity7.2.4
Airbase7.2.4
Apiiro11.3.1, 6.3.3
Aqua Security11.3.1, 6.3.3
Arctic Wolf5.2.1
Arnica11.3.1, 6.3.3
Blackpoint Cyber5.2.1
Bugsnag7.2.4
Carta7.2.4
Checkmk10.4.1, 7.2.4
Cloudanix11.3.1, 6.3.3
Cohere7.2.4
Concord7.2.4
Contractbook7.2.4
ContractSafe7.2.4
CoreStack11.3.1, 6.3.3
CyberArk7.2.4, 8.4.2
Cynet5.2.1
Cyscale11.3.1, 6.3.3
Cyware12.10.1
DeepSeek7.2.4
Documenso7.2.4
Edgescan11.3.1, 6.3.3
Eversign7.2.4
Evisort7.2.4
Foxit eSign7.2.4
Freshsales7.2.4
Gatekeeper7.2.4
GetAccept7.2.4
GitKraken7.2.4
Groq7.2.4
Honeycomb10.4.1
IBM MaaS36012.5.1
Juro7.2.4
Kion11.3.1, 6.3.3
LastPass SSO7.2.4, 8.4.2
Legit Security11.3.1, 6.3.3
Lexion7.2.4
LinkSquares7.2.4
Lookout5.2.1
Matillion7.2.4
MessageBird7.2.4
Microsoft 365 Copilot7.2.4
Nagios10.4.1
Nessus11.3.1, 6.3.3
Netdata7.2.4
Nextiva7.2.4
OpenVAS11.3.1, 6.3.3
Orca Security11.3.1, 6.3.3
pCloud7.2.4
Perplexity7.2.4
Phylum11.3.1, 6.3.3
Pipedream7.2.4
Plivo7.2.4
Postmark7.2.4
Precoro7.2.4
Rapid7 InsightCloudSec11.3.1, 6.3.3
Rapid7 InsightConnect12.10.1
Raygun7.2.4
Replicate7.2.4
Responsive7.2.4
RightSignature7.2.4
Rippling MDM12.5.1
RiskRecon11.3.1, 6.3.3
RudderStack7.2.4
SAP Ariba7.2.4
Scalefusion12.5.1
Signable7.2.4
Signeasy7.2.4
SignWell7.2.4
Skribble7.2.4
Sonrai Security11.3.1, 6.3.3
SOTI MobiControl12.5.1
SpotDraft7.2.4
Stitch7.2.4
Storj7.2.1
Stream Security11.3.1, 6.3.3
Sweet Security11.3.1, 6.3.3
Swimlane12.10.1
Sysdig11.3.1, 6.3.3
Tenable Cloud Security11.3.1, 6.3.3
Together AI7.2.4
Twilio7.2.4
Uptycs11.3.1, 6.3.3
Vonage7.2.4
Wallarm11.3.1, 6.3.3
Yotta1.3.1, 10.2.1, 10.5.1, 11.3.1, 3.5.1, 3.7.4, 7.2.1, 7.2.2, 8.4.2, 8.6.3
Z.ai (Zhipu GLM)7.2.4
Zip7.2.4
Zoho Sign7.2.4
Zscaler Posture Control11.3.1, 6.3.3

Controls (47)

ControlTitleAutomated testsConnectors
1.3.1Inbound traffic to the CDE is restricted to only that which is necessary5836
1.5.1Security controls are implemented on computing devices that connect to both untrusted networks and the CDE113
2.2.1Configuration standards are developed, implemented, and maintained4924
3.5.1PAN is rendered unreadable anywhere it is stored2243
3.7.4Cryptographic keys are changed at the end of their defined cryptoperiod2118
4.2.1Strong cryptography protects PAN during transmission over open, public networks4027
5.2.1An anti-malware solution is deployed on all system components, except those evaluated as not at risk740
5.3.1The anti-malware solution is kept current via automatic updates125
5.3.5Anti-malware mechanisms cannot be disabled or altered by users unless specifically authorized15
5.4.1Processes and automated mechanisms detect and protect personnel against phishing attacks16
6.2.2Software development personnel are trained at least once every 12 months21
6.2.4Software engineering techniques prevent or mitigate common software attacks48
6.3.1Security vulnerabilities are identified and assigned a risk ranking515
6.3.2An inventory of bespoke and custom software and its third-party components is maintained58
6.3.3System components are protected from known vulnerabilities by installing applicable patches40128
6.4.2An automated technical solution detects and prevents web-based attacks for public-facing web applications39
6.5.1Changes to production system components follow established change procedures1828
7.2.1An access control model is defined4439
7.2.2Access is assigned based on job classification and least privilege50186
7.2.4User accounts and access privileges are reviewed at least once every six months15276
8.2.1Every user is assigned a unique ID24
8.2.5Access for terminated users is immediately revoked14221
8.2.6Inactive user accounts are removed or disabled within 90 days of inactivity935
8.2.8Sessions idle for more than 15 minutes require re-authentication328
8.3.4Invalid authentication attempts are limited (lockout after not more than 10 attempts)116
8.3.6Passwords meet minimum complexity (12 characters, numeric and alphabetic)526
8.4.1MFA for all non-console access into the CDE for personnel with administrative access317
8.4.2MFA for all access into the CDE2695
8.6.3Passwords for application and system accounts are protected against misuse3748
10.2.1Audit logs are enabled and active for all system components and cardholder data5234
10.3.2Audit log files are protected to prevent modifications by individuals411
10.4.1Security-event and critical-component audit logs are reviewed at least once daily3637
10.5.1Audit log history is retained for at least 12 months, three months immediately available1536
11.3.1Internal vulnerability scans are performed at least once every three months2182
11.4.2Internal penetration testing is performed at least once every 12 months and after significant changes11
11.4.3External penetration testing is performed at least once every 12 months and after significant changes11
11.5.1Intrusion-detection and/or intrusion-prevention techniques detect and/or prevent intrusions1516
11.5.2A change-detection mechanism alerts personnel to unauthorized modification of critical files411
12.1.1An overall information security policy is established, published, maintained, and disseminated20
12.1.2The information security policy is reviewed at least once every 12 months10
12.5.1An inventory of in-scope system components, with a description of function or use, is maintained and kept current533
12.6.1A formal security awareness program is implemented37
12.6.3.1Security awareness training covers threats such as phishing and social engineering12
12.7.1Potential personnel with access to the CDE are screened prior to hire21
12.10.1An incident response plan exists and is ready to be activated in the event of a suspected or confirmed incident1860
12.10.2The incident response plan is reviewed and tested at least once every 12 months10
12.10.6The security incident response plan is modified and evolved according to lessons learned and to incorporate industry developments218

HIPAA Security Rule and connectors

Which connectors provide evidence for HIPAA Security Rule, for which controls, and how to connect them.

NIST CSF 2.0 and connectors

Which connectors provide evidence for NIST CSF 2.0, for which controls, and how to connect them.

On this page

How to connect for this frameworkConnectors with automated evidence (343)Evidence by attestation (94)Controls (47)