All frameworks Payments

PCI DSS v4.0.1 (Payment Card Industry Data Security Standard)

Mandatory for any organization that stores, processes, or transmits cardholder data. v4.x is the only active version; the 51 future-dated requirements became mandatory on 31 March 2025. Uniquely, PCI is explicit about phishing-resistant authentication: under Req 8.4.2 a FIDO2 authenticator can stand alone in place of MFA — the only major framework that credits hardware keys this directly.

Merchants, payment processors, service providers, any e-commerce operator

11

control domains mapped

48

products applicable

11

other frameworks cross-mapped

PCI DSS v4.0.1 (Payment Card Industry Data Security Standard)

8.4.2 MFA for all non-console access into the CDE — a FIDO2 authenticator may stand alone in place of MFA (FAQ 1595); 8.4.1/8.4.3 still need a second factor

Phishing-resistant MFA using hardware security keys. Software TOTP and SMS are explicitly excluded from "phishing-resistant" in NIST 800-63B and most modern framework guidance.

Products that satisfy this control:

Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardware security module Nitrokey HSM 2 $135 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Amazon affiliate YubiKey Developer board Nitrokey 3A NFC Hacker $100

Same control in other frameworks:

NIST 800-53 IA-2(6) NIST CSF 2.0 PR.AA-03 ISO 27001 A.8.5 SOC 2 CC6.1 NIS2 Art.21(2)(i) CMMC 2.0 IA.L2-3.5.3 CIS Controls v8 CIS-6.3 HIPAA Security Rule §164.312(d) DORA Art. 9(4)(d) Essential Eight E8-MFA Cyber Essentials CE-4

3.7.1 Key-management policies and procedures for cryptographic keys protecting stored account data

Hardware-bound key generation and storage. Private keys generated and stored inside a certified secure element (EAL 6+) and are non-exportable by design — for login credentials (Nitrokey) and crypto-asset custody (Ledger) alike.

Products that satisfy this control:

Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardware security module Nitrokey HSM 2 $135 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Hardware wallet Ledger Stax $399 Hardware wallet Ledger Flex $249 Hardware wallet Ledger Nano Gen5 $179 Hardware wallet Ledger Nano X $99 Hardware wallet Ledger Nano S Plus $59 Security key Nitrokey Pro 2 $135 Security key Nitrokey Start $60 Developer board Nitrokey 3A NFC Hacker $100 Amazon affiliate YubiKey

Same control in other frameworks:

NIST 800-53 SC-12 NIST CSF 2.0 PR.DS-02 ISO 27001 A.8.24 SOC 2 CC6.1 NIS2 Art.21(2)(h) CMMC 2.0 SC.L2-3.13.10 CIS Controls v8 CIS-3.11 HIPAA Security Rule §164.312(a)(2)(iv) DORA Art. 9(4)(d)

1.5.1 Controls for computing devices that connect to both untrusted networks and the CDE

Hardened mobile OS with per-app sensor controls, verified boot, and no background telemetry. Satisfies mobile device management and bring-your-own-device security requirements.

Products that satisfy this control:

Hardened phone NitroPhone 10 Pro $1,235 Hardened phone NitroPhone 10 Pro XL $1,750 Hardened phone NitroPhone 5a $965 Hardened phone NitroPhone 10 $1,035 Hardened phone NitroPhone 10 Pro Fold $2,000 Hardened phone NitroPhone 5 Pro $1,000 Hardened phone NitroPhone 5 Pro XL $1,380 Hardened tablet NitroTablet 1 $2,000 Hardened phone NitroPhone 10a $810 Privacy smartphone NovaCustom PrivacyGuard SHIFTphone 8.1 $889 Hardened mobile GrapheneOS Pixels

Same control in other frameworks:

NIST 800-53 AC-19 NIST CSF 2.0 PR.AC-3 ISO 27001 A.8.1 SOC 2 CC6.8 NIS2 Art.21(2)(e) CMMC 2.0 AC.L2-3.1.18 CIS Controls v8 CIS-4.4 HIPAA Security Rule §164.310(d)(1) Cyber Essentials CE-2

11.5.2 Change-detection mechanism to alert on unauthorized modification of critical files

Measured boot chain verified on every power-on. Any firmware modification — supply chain implant, evil-maid attack, or malicious update — fails attestation before the OS loads.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Secure desktop NitroPC 2 $1,085 Hardened mobile GrapheneOS Pixels

Same control in other frameworks:

NIST 800-53 SI-7 NIST CSF 2.0 DE.CM-09 ISO 27001 A.8.8 SOC 2 CC7.1 NIS2 Art.21(2)(e) CMMC 2.0 SI.L2-3.14.6 CIS Controls v8 CIS-2.3 HIPAA Security Rule §164.312(c)(1) DORA Art. 9(2) Cyber Essentials CE-2

2.2.1 System configuration standards applied to all system components

VM-level compartmentalization means a compromise of one domain (e.g. browser) cannot reach another (e.g. keys, vault). No other consumer laptop provides this by default.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Secure desktop NitroPC 2 $1,085

Same control in other frameworks:

NIST 800-53 SC-3 NIST CSF 2.0 PR.AC-5 ISO 27001 A.8.22 SOC 2 CC6.6 NIS2 Art.21(2)(e) CMMC 2.0 SC.L2-3.13.3 CIS Controls v8 CIS-12.2 HIPAA Security Rule §164.312(a)(1) DORA Art. 9(4)(c)

1.4.1 Network security controls between trusted and untrusted networks

Stateful firewall with IPS at the network perimeter. All inbound/outbound traffic inspected with Suricata rule sets. VPN gateway replaces consumer VPN dependency.

Products that satisfy this control:

Network security NitroWall V1410 $835 Network security NitroWall NW750 $375 Network security NitroWall VP4670 $1,540 Network Network appliances DIY Raspberry Pi builds

Same control in other frameworks:

NIST 800-53 SC-7 NIST CSF 2.0 PR.AC-5 ISO 27001 A.8.22 SOC 2 CC6.7 NIS2 Art.21(2)(e) CMMC 2.0 SC.L2-3.13.1 CIS Controls v8 CIS-12.3 HIPAA Security Rule §164.312(e)(1) DORA Art. 9(4)(b) Cyber Essentials CE-1

3.5.1 PAN rendered unreadable anywhere it is stored

Hardware-encrypted storage and self-hosted file servers replace cloud storage with hardware you control. Encryption keys never leave your environment.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure storage NextBox NAS $450 Hardware security module Nitrokey HSM 2 $135 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Secure storage Nitrokey Storage 2 (64 GB) $250 Secure desktop NitroPC 2 $1,085

Same control in other frameworks:

NIST 800-53 SC-28 NIST CSF 2.0 PR.DS-01 ISO 27001 A.8.24 SOC 2 CC6.1 NIS2 Art.21(2)(h) CMMC 2.0 SC.L2-3.13.16 CIS Controls v8 CIS-3.11 HIPAA Security Rule §164.312(a)(2)(iv) DORA Art. 9(2)

12.8.1 List of third-party service providers with whom account data is shared

Open-source firmware is publicly auditable and reproducibly built. EU jurisdiction hardware is not subject to US National Security Letters. Directly addresses hardware supply chain risk in CMMC and NIS2.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardened phone NitroPhone 10 Pro $1,235 Hardened phone NitroPhone 10 Pro XL $1,750 Hardened phone NitroPhone 5a $965 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Hardened phone NitroPhone 10 $1,035 Hardened phone NitroPhone 10 Pro Fold $2,000 Hardened phone NitroPhone 5 Pro $1,000 Hardened phone NitroPhone 5 Pro XL $1,380 Hardened tablet NitroTablet 1 $2,000 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Security key Nitrokey Pro 2 $135 Security key Nitrokey Start $60 Developer board Nitrokey 3A NFC Hacker $100 Secure storage Nitrokey Storage 2 (64 GB) $250 Hardened phone NitroPhone 10a $810 Secure desktop NitroPC 2 $1,085 Network security NitroWall NW750 $375 Network security NitroWall VP4670 $1,540 Privacy smartphone NovaCustom PrivacyGuard SHIFTphone 8.1 $889 Hardened mobile GrapheneOS Pixels Physical Tamper-evident & locks

Same control in other frameworks:

NIST 800-53 SR-3 NIST CSF 2.0 GV.SC-06 ISO 27001 A.5.19 SOC 2 CC9.2 NIS2 Art.21(2)(d) CMMC 2.0 CM.L2-3.4.1 CIS Controls v8 CIS-15.1 HIPAA Security Rule §164.308(b)(1) DORA Art. 28

9.5.1 POI devices protected from tampering and unauthorized substitution

Intel Management Engine disabled at the firmware level across every open-firmware machine we carry (NitroPad, NitroPC, PrivacyGuard, SecurityTitan); SecurityTitan models go further — camera and microphone physically removed, anti-tamper seals verified by Heads + Nitrokey attestation. Least functionality, enforced in hardware.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Secure desktop NitroPC Pro 2 $2,230 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Accessory Data blocker (USB-C/C) $15 Accessory Data blocker (USB-A/C) $15 Physical Tamper-evident & locks

Same control in other frameworks:

NIST 800-53 SC-42 NIST CSF 2.0 PR.PS-01 ISO 27001 A.8.9 SOC 2 CC6.8 NIS2 Art.21(2)(e) CMMC 2.0 CM.L2-3.4.6 CIS Controls v8 CIS-4.8 HIPAA Security Rule §164.310(d)(1)

9.4.1 Media with cardholder data physically secured

Rated safes and vaults protect physical assets, documents, and hardware backups with UL-certified burglary ratings — from UL 1037 RSC (residential) up to UL 687 TL-15/TL-30 vault-grade for insurance-mandated or enterprise specialty storage (the tier insurers and auditors recognize; see the ratings ladder on /safe). SecurityTitan laptops extend physical protection to devices in transit: glitter-sealed tamper-evident screws with photographic verification make case intrusion detectable.

Products that satisfy this control:

Physical Safe & vault Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Physical Tamper-evident & locks Signal blocking Faraday bags

Same control in other frameworks:

NIST 800-53 PE-3 NIST CSF 2.0 PR.AC-2 ISO 27001 A.7.1 SOC 2 CC6.4 NIS2 Art.21(2)(i) CMMC 2.0 PE.L1-3.10.1 CIS Controls v8 CIS-11.5 HIPAA Security Rule §164.310(a)(1) DORA Art. 9(4)(c)

4.2.1 Strong cryptography for PAN transmitted over open, public networks

Verified boot ensures the TLS stack is unmodified before communication. VPN gateway encrypts all remote access traffic. Hardware-backed keys prevent interception even if endpoints are observed.

Products that satisfy this control:

Hardened phone NitroPhone 10 Pro $1,235 Hardened phone NitroPhone 10 Pro XL $1,750 Hardened phone NitroPhone 5a $965 Network security NitroWall V1410 $835 Hardened phone NitroPhone 10 $1,035 Hardened phone NitroPhone 10 Pro Fold $2,000 Hardened phone NitroPhone 5 Pro $1,000 Hardened phone NitroPhone 5 Pro XL $1,380 Hardened tablet NitroTablet 1 $2,000 Privacy Mullvad VPN Off-grid comms LoRa mesh radios

Same control in other frameworks:

NIST 800-53 SC-8 NIST CSF 2.0 PR.DS-02 ISO 27001 A.8.26 SOC 2 CC6.7 NIS2 Art.21(2)(h) CMMC 2.0 SC.L2-3.13.8 CIS Controls v8 CIS-3.10 HIPAA Security Rule §164.312(e)(2)(ii) DORA Art. 9(2)

Also mapped to

NIST 800-53 US NIST CSF 2.0 US ISO 27001 Global SOC 2 US NIS2 EU CMMC 2.0 US DoD HIPAA Security Rule US HHS DORA EU Essential Eight AU Cyber Essentials UK CIS Controls v8 Global