CMMC · MA Maintenance
MA.L2-3.7.1
Perform Maintenance
Official textPerform maintenance on organizational systems.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-08PR.PS-02 | Systems, hardware, software, services, and data are managed throughout their life cycles; Software is maintained, replaced, and removed commensurate with risk | No mapping. Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping | |
| ISO 27001 | A.5.9A.5.8A.5.11A.5.12 | Inventory of information and other associated assets; Information security in project management… | No mapping. Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping | |
| CIS v8.1 | CIS 2.3CIS 1.1CIS 2.2CIS 3.5 | Address Unauthorized Software; Establish and Maintain Detailed Enterprise Asset Inventory… | No mapping. Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping+9 more loosely related (not mappings)CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping …and 5 more in the downloads | |
| SOC 2 | CC6.1CC7.1 | Logical access security over information assets; Detecting configuration changes and new vulnerabilities | No mapping. Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping | |
| PCI DSS | 6.3.16.3.312.3.46.2.1 | Vulnerabilities identified and risk-ranked; Security patches installed promptly… | No mapping. Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping+6 more loosely related (not mappings)6.2.2 Developers trained in secure software development Only shares CSF ID.AM-08: related, not a mapping 6.2.3.1 Manual code reviews approved by someone else Only shares CSF ID.AM-08: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Only shares CSF ID.AM-08: related, not a mapping …and 2 more in the downloads | |
| 800-53 | MA-2MA-3 | Controlled Maintenance; Maintenance Tools | Crosswalk | NIST SP 800-171r2 Appendix D18 loosely related (not mappings)PM-22 Personally Identifiable Information Quality Management Only shares CSF ID.AM-08: related, not a mapping …and 10 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(B)§164.308(b)(4)§164.310(a)(2)(ii)§164.310(a)(2)(iv) | Risk Management; Written Contract or Other Arrangement… | No mapping. Only shares CSF ID.AM-08: related, not a mapping+13 more loosely related (not mappings)§164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.PS-02: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads | |
| GDPR | Art.30(1) | Records of processing activities | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| NIS2 | 6.26.66.1012.4 | Secure development life cycle; Security patch management… | No mapping. Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping | |
| Essential Eight | ISM-1807ISM-0304ISM-1407ISM-1501 | An automated method of asset discovery is used at least fortnightly to support the…; Applications other than office productivity suites, web browsers and their extensions…… | No mapping. Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping+25 more loosely related (not mappings)ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF PR.PS-02: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Only shares CSF PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF PR.PS-02: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Only shares CSF PR.PS-02: related, not a mapping …and 21 more in the downloads | |
| DORA | Art.8(1)Art.8(4)Art.8(6)Art.9(4)(f) | Identification; Identification… | No mapping. Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping | |
| CPS 234 | Para 20 | Classify information assets by criticality and sensitivity | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| Cyber Essentials | CE 3 | Security Update Management | No mapping. Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.