Controls Matrix
PCIComplianceHubLast updated
The document an organization produces for each requirement it meets through the Customized Approach, describing the control in place, how it meets the customized approach objective, how its effectiveness is tested and maintained, and who is accountable for it. Together with the targeted risk analysis, the controls matrix is what an assessor uses to derive bespoke testing procedures for that control. PCI DSS Appendix E provides a sample template.
Applies to. The controls matrix is a Customized Approach artefact. 12.3.2 requires, for each PCI DSS requirement met with the Customized Approach, a targeted risk analysis with documented evidence covering each element in Appendix D, including at a minimum a controls matrix and a risk analysis, approved by senior management and performed at least once every 12 months. The entity produces it before the assessment; the assessor uses it, with the risk analysis, to derive the testing procedures for that control.
Limits. A controls matrix is not a compensating control worksheet. The matrix documents a control chosen under the Customized Approach to meet the stated objective; the worksheet documents a compensating control used because the defined requirement cannot be met as written.
In PCI DSS v4.0.1. 12.3.2
Related. Customized Approach, Customized Approach Objective, Targeted Risk Analysis (TRA), Defined Approach, Compensating Control Worksheet (CCW)
Sources. PCI DSS v4.0.1 (June 2024)