Vulnerability Remediation

frameworkCMMC Level 2 sectionRA Risk Assessment csf 2.0GV.SC-10 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01 ID.RA-08 topicsVulnerability Mgmt frameworks7 6 0

Official textRemediate vulnerabilities in accordance with risk assessments.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of RA.L2-3.11.3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.RA-01 ID.RA-08	Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established	Crosswalk	Same topic: Vulnerability Mgmt 1 loosely related (not mappings) GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping
ISO 27001	A.8.8	Management of technical vulnerabilities	Crosswalk	Same topic: Vulnerability Mgmt 7 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.SC-10, ID.IM-02: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-10, ID.RA-08: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-10: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-10: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.SC-10: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-10: related, not a mapping
CIS v8.1	CIS 7.1 CIS 7.2 CIS 7.5 CIS 7.6 CIS 7.7 CIS 16.6 CIS 18.1 CIS 18.2 CIS 18.3 CIS 18.4 CIS 18.5	Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process…	Crosswalk	Same topic: Vulnerability Mgmt 1 loosely related (not mappings) CIS 15.7 Securely Decommission Service Providers Loosely related Only shares CSF GV.SC-10: related, not a mapping
SOC 2	CC7.1	Detecting configuration changes and new vulnerabilities	Editorial	Same topic: Vulnerability Mgmt (editorial pick)
PCI DSS	6.3.1 11.3.1 11.3.2	Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months…	Crosswalk	Same topic: Vulnerability Mgmt 16 loosely related (not mappings) 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF ID.IM-02, ID.RA-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.SC-10, ID.IM-01: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.SC-10: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-10: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF GV.SC-10: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF ID.RA-01: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-10: related, not a mapping 8.2.5 Access revoked immediately on termination Loosely related Only shares CSF GV.SC-10: related, not a mapping …and 8 more in the downloads
800-53	CA-8 RA-5	Penetration Testing; Vulnerability Monitoring and Scanning	Crosswalk	Same topic: Vulnerability Mgmt 15 loosely related (not mappings) RA-3 Risk Assessment Loosely related Only shares CSF GV.SC-10, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping CA-2 Control Assessments Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.SC-10, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SA-11 Developer Testing and Evaluation Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.SC-10, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.SC-10, ID.IM-02, ID.IM-03: related, not a mapping …and 7 more in the downloads
HIPAA	§164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)	Evaluation; Risk Analysis…	Crosswalk	Same topic: Vulnerability Mgmt 10 loosely related (not mappings) §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.SC-10, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.316(b) Documentation Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-10, ID.IM-03: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF GV.SC-10, ID.IM-03: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-10, ID.IM-03: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-10, ID.IM-03: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.SC-10: related, not a mapping …and 2 more in the downloads
GDPR	Art.32(1)(d)	Security of processing	Editorial	Same topic: Vulnerability Mgmt (editorial pick)
NIS2	6.5 6.10	Security testing; Vulnerability handling and disclosure	Crosswalk	Same topic: Vulnerability Mgmt 2 loosely related (not mappings) 2.1 Risk management framework Loosely related Only shares CSF ID.RA-01: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.SC-10: related, not a mapping
Essential Eight	ISM-1698 ISM-1699 ISM-1701 ISM-1702 ISM-1807 ISM-1808	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…; A vulnerability scanner is used at least weekly to identify missing patches or updates……	Editorial	Same topic: Vulnerability Mgmt (editorial pick) 23 loosely related (not mappings) ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 15 more in the downloads
DORA	Art.8(2)Art.25(1)Art.26(1)Art.27(1)	Identification; Testing of ICT tools and systems…	Editorial	Same topic: Vulnerability Mgmt (editorial pick)
CPS 234	Para 17 Para 27 Para 30	Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness…	Editorial	Same topic: Vulnerability Mgmt (editorial pick)
Cyber Essentials	CE 3	Security Update Management	Editorial	Same topic: Vulnerability Mgmt (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.