CMMC · MA Maintenance
MA.L2-3.7.2
System Maintenance Control
Official textProvide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | No mapping. Only shares CSF PR.PS-02: related, not a mapping | |
| ISO 27001 | A.5.9A.8.7 | Inventory of information and other associated assets; Protection against malware | No mapping. Only shares CSF PR.PS-02: related, not a mapping | |
| CIS v8.1 | CIS 2.2CIS 2.3CIS 7.3CIS 7.4 | Ensure Authorized Software is Currently Supported; Address Unauthorized Software… | No mapping. Only shares CSF PR.PS-02: related, not a mapping+1 more loosely related (not mappings)CIS 12.1 Ensure Network Infrastructure is Up-to-Date Only shares CSF PR.PS-02: related, not a mapping | |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | No mapping. Only shares CSF PR.PS-02: related, not a mapping | |
| PCI DSS | 6.3.16.3.26.3.312.3.4 | Vulnerabilities identified and risk-ranked; Inventory of custom software and its components… | No mapping. Only shares CSF PR.PS-02: related, not a mapping | |
| 800-53 | MA-2MA-3MA-5 | Controlled Maintenance; Maintenance Tools… | Crosswalk | NIST SP 800-171r2 Appendix D; NIST SP 800-171r3 03.07.04 → SP 800-53; NIST SP 800-171r3 03.07.06 → SP 800-534 loosely related (not mappings) |
| HIPAA | §164.312(c)§164.312(c)(2)§164.312(e)(2)(i) | Integrity; Mechanism to Authenticate Electronic Protected Health Information… | No mapping. Only shares CSF PR.PS-02: related, not a mapping | |
| GDPR | — | No requirement | No mapping in our data | No mapping in our data (only GDPR's security articles are mapped, editorially). |
| NIS2 | 6.66.10 | Security patch management; Vulnerability handling and disclosure | No mapping. Only shares CSF PR.PS-02: related, not a mapping | |
| Essential Eight | ISM-0304ISM-1407ISM-1501ISM-1690 | Applications other than office productivity suites, web browsers and their extensions…; The latest release, or the previous release, of operating systems are used… | No mapping. Only shares CSF PR.PS-02: related, not a mapping+25 more loosely related (not mappings)ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Only shares CSF PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF PR.PS-02: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Only shares CSF PR.PS-02: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF PR.PS-02: related, not a mapping …and 21 more in the downloads | |
| DORA | Art.9(4)(f) | Protection and prevention | No mapping. Only shares CSF PR.PS-02: related, not a mapping | |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | CE 3 | Security Update Management | No mapping. Only shares CSF PR.PS-02: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.