Flaw Remediation

frameworkCMMC Level 2 sectionSI System and Information Integrity csf 2.0ID.IM-01 ID.IM-02 ID.IM-03 PR.PS-02 topicsPatch Management frameworks6 4 2

Official textIdentify, report, and correct system flaws in a timely manner.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of SI.L2-3.14.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.PS-02	Software is maintained, replaced, and removed commensurate with risk	Crosswalk	Same topic: Patch Management
ISO 27001	A.8.8	Management of technical vulnerabilities	Crosswalk	Same topic: Patch Management 2 loosely related (not mappings) A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF PR.PS-02: related, not a mapping A.8.7 Protection against malware Loosely related Only shares CSF PR.PS-02: related, not a mapping
CIS v8.1	CIS 2.2 CIS 7.3 CIS 7.4 CIS 12.1	Ensure Authorized Software is Currently Supported; Perform Automated Operating System Patch Management…	Crosswalk	Same topic: Patch Management 1 loosely related (not mappings) CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF PR.PS-02: related, not a mapping
SOC 2	CC7.1	Detecting configuration changes and new vulnerabilities	Editorial	Same topic: Patch Management (editorial pick)
PCI DSS	6.3.1 6.3.3	Vulnerabilities identified and risk-ranked; Security patches installed promptly	Crosswalk	Same topic: Patch Management 2 loosely related (not mappings) 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF ID.IM-01, PR.PS-02: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF PR.PS-02: related, not a mapping
800-53	SI-2 SI-3 SI-5	Flaw Remediation; Malicious Code Protection…	Crosswalk	Same topic: Patch Management NIST SP 800-171r2 Appendix D 4 loosely related (not mappings) CM-11 User-installed Software Loosely related Only shares CSF PR.PS-02: related, not a mapping MA-3 Maintenance Tools Loosely related Only shares CSF PR.PS-02: related, not a mapping SA-10 Developer Configuration Management Loosely related Only shares CSF PR.PS-02: related, not a mapping SI-7 Software, Firmware, and Information Integrity Loosely related Only shares CSF PR.PS-02: related, not a mapping
HIPAA	§164.312(c)§164.312(c)(2)§164.312(e)(2)(i)	Integrity; Mechanism to Authenticate Electronic Protected Health Information…	Loosely related	No mapping. Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.PS-02: related, not a mapping
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	6.6	Security patch management	Crosswalk	Same topic: Patch Management 1 loosely related (not mappings) 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF PR.PS-02: related, not a mapping
Essential Eight	ISM-1501 ISM-1691 ISM-1693 ISM-1695 ISM-1704 ISM-1876 ISM-1877	Operating systems that are no longer supported by vendors are replaced; Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release…	Editorial	Same topic: Patch Management (editorial pick) 22 loosely related (not mappings) ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1696 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1697 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1698 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online… Loosely related Only shares CSF PR.PS-02: related, not a mapping …and 14 more in the downloads
DORA	Art.9(4)(f)	Protection and prevention	Editorial	Same topic: Patch Management (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 3	Security Update Management	Editorial	Same topic: Patch Management (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.