Ensure Network Infrastructure is Up-to-Date

frameworkCIS Controls v8.1 section12. Network Infrastructure Management csf 2.0PR.PS-02 topicsPatch Management frameworks0 10 2

Official text · not licensableSafeguard title © CIS (CC BY-NC-ND 4.0). See CIS Controls v8.1 for details.

gap from CIS v8.1 → gap to CIS v8.1 →

Wrong or missing mapping? Report it

Equivalents of CIS 12.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.PS-02	Software is maintained, replaced, and removed commensurate with risk	Editorial	Same topic: Patch Management (editorial pick)
ISO 27001	A.8.8	Management of technical vulnerabilities	Editorial	Same topic: Patch Management (editorial pick) 2 loosely related (not mappings) A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF PR.PS-02: related, not a mapping A.8.7 Protection against malware Loosely related Only shares CSF PR.PS-02: related, not a mapping
SOC 2	CC7.1	Detecting configuration changes and new vulnerabilities	Editorial	Same topic: Patch Management (editorial pick)
PCI DSS	6.3.1 6.3.3	Vulnerabilities identified and risk-ranked; Security patches installed promptly	Editorial	Same topic: Patch Management (editorial pick) 2 loosely related (not mappings) 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF PR.PS-02: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF PR.PS-02: related, not a mapping
CMMC	SI.L2-3.14.1	Flaw Remediation	Editorial	Same topic: Patch Management (editorial pick) 3 loosely related (not mappings) MA.L2-3.7.1 Perform Maintenance Loosely related Only shares CSF PR.PS-02: related, not a mapping MA.L2-3.7.2 System Maintenance Control Loosely related Only shares CSF PR.PS-02: related, not a mapping MA.L2-3.7.4 Media Inspection Loosely related Only shares CSF PR.PS-02: related, not a mapping
800-53	SI-2	Flaw Remediation	Editorial	Same topic: Patch Management (editorial pick) 4 loosely related (not mappings) CM-11 User-installed Software Loosely related Only shares CSF PR.PS-02: related, not a mapping MA-3 Maintenance Tools Loosely related Only shares CSF PR.PS-02: related, not a mapping SA-10 Developer Configuration Management Loosely related Only shares CSF PR.PS-02: related, not a mapping SI-7 Software, Firmware, and Information Integrity Loosely related Only shares CSF PR.PS-02: related, not a mapping
HIPAA	§164.312(c)§164.312(c)(2)§164.312(e)(2)(i)	Integrity; Mechanism to Authenticate Electronic Protected Health Information…	Loosely related	No mapping. Only shares CSF PR.PS-02: related, not a mapping
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	6.6	Security patch management	Editorial	Same topic: Patch Management (editorial pick) 1 loosely related (not mappings) 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF PR.PS-02: related, not a mapping
Essential Eight	ISM-1501 ISM-1691 ISM-1693 ISM-1695 ISM-1704 ISM-1876 ISM-1877	Operating systems that are no longer supported by vendors are replaced; Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release…	Editorial	Same topic: Patch Management (editorial pick) 22 loosely related (not mappings) ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1696 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1697 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1698 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online… Loosely related Only shares CSF PR.PS-02: related, not a mapping …and 14 more in the downloads
DORA	Art.9(4)(f)	Protection and prevention	Editorial	Same topic: Patch Management (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 3	Security Update Management	Editorial	Same topic: Patch Management (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.