CIS v8.1 · 2. Inventory and Control of Software Assets
CIS 2.3
Address Unauthorized Software
frameworkCIS Controls v8.1
section2. Inventory and Control of Software Assets
csf 2.0ID.AM-01 ID.AM-02 ID.AM-04 ID.AM-08 PR.PS-02
topicsAsset Management
frameworks0 13 0
Official text · not licensableSafeguard title © CIS (CC BY-NC-ND 4.0). See CIS Controls v8.1 for details.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-01ID.AM-02ID.AM-04ID.AM-08 | Inventories of hardware managed by the organization are maintained; Inventories of software, services, and systems managed by the organization are maintained… | Editorial | Same topic: Asset Management (editorial pick)1 loosely related (not mappings)PR.PS-02 Software is maintained, replaced, and removed commensurate with risk Only shares CSF PR.PS-02: related, not a mapping |
| ISO 27001 | A.5.9A.5.11A.7.14 | Inventory of information and other associated assets; Return of assets… | Editorial | Same topic: Asset Management (editorial pick) |
| SOC 2 | CC6.1 | Logical access security over information assets | Editorial | Same topic: Asset Management (editorial pick) |
| PCI DSS | 6.3.212.5.1 | Inventory of custom software and its components; Inventory of in-scope system components | Editorial | Same topic: Asset Management (editorial pick)17 loosely related (not mappings)6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping 6.3.3 Security patches installed promptly Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping 12.8.1 List of third-party service providers kept Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping 6.2.1 Bespoke and custom software developed securely Only shares CSF ID.AM-08: related, not a mapping 6.2.2 Developers trained in secure software development Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads |
| CMMC | CM.L2-3.4.1 | System Baselining | Editorial | Same topic: Asset Management (editorial pick)9 loosely related (not mappings)…and 1 more in the downloads |
| 800-53 | CM-8PM-5 | System Component Inventory; System Inventory | Editorial | Same topic: Asset Management (editorial pick)24 loosely related (not mappings)…and 16 more in the downloads |
| HIPAA | §164.310(d)§164.310(d)(2)(iii) | Device and Media Controls; Accountability | Editorial | Same topic: Asset Management (editorial pick)20 loosely related (not mappings)§164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.PS-02: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping …and 12 more in the downloads |
| GDPR | Art.30(1) | Records of processing activities | Editorial | Same topic: Asset Management (editorial pick)1 loosely related (not mappings) |
| NIS2 | 12.4 | Asset inventory | Editorial | Same topic: Asset Management (editorial pick) |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | Editorial | Same topic: Asset Management (editorial pick)28 loosely related (not mappings)ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF PR.PS-02: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF PR.PS-02: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Only shares CSF PR.PS-02: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF PR.PS-02: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Only shares CSF PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF PR.PS-02: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Only shares CSF PR.PS-02: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF PR.PS-02: related, not a mapping …and 20 more in the downloads |
| DORA | Art.8(1)Art.8(4)Art.8(6) | Identification; Identification… | Editorial | Same topic: Asset Management (editorial pick)3 loosely related (not mappings) |
| CPS 234 | Para 20 | Classify information assets by criticality and sensitivity | Editorial | Same topic: Asset Management (editorial pick) |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Asset Management (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.