Cyber Essentials · Technical controls
CE 3
Security Update Management
frameworkUK Cyber Essentials (NCSC)
sectionTechnical controls
csf 2.0ID.AM-01 ID.AM-02 ID.AM-04 ID.AM-08 ID.RA-01 ID.RA-08 PR.PS-02
topicsAsset Management, Vulnerability Mgmt, Patch Management
frameworks0 13 0
Official text · not licensableSee the official text of UK Cyber Essentials (NCSC).
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-01ID.AM-02ID.AM-04ID.AM-08ID.RA-01ID.RA-08PR.PS-02 | Inventories of hardware managed by the organization are maintained; Inventories of software, services, and systems managed by the organization are maintained… | Editorial | Same topic: Asset Management, Vulnerability Mgmt, Patch Management (editorial pick) |
| ISO 27001 | A.5.9A.5.11A.7.14A.8.8 | Inventory of information and other associated assets; Return of assets… | Editorial | Same topic: Asset Management, Vulnerability Mgmt, Patch Management (editorial pick) |
| CIS v8.1 | CIS 1.1CIS 1.2CIS 1.3CIS 1.4CIS 1.5CIS 2.1CIS 2.2CIS 2.3CIS 2.4CIS 7.1CIS 7.2CIS 7.3CIS 7.4CIS 7.5CIS 7.6CIS 7.7CIS 12.1CIS 16.4CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain Detailed Enterprise Asset Inventory; Address Unauthorized Assets… | Editorial | Same topic: Asset Management, Patch Management, Vulnerability Mgmt (editorial pick) |
| SOC 2 | CC6.1CC7.1 | Logical access security over information assets; Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Asset Management, Vulnerability Mgmt, Patch Management (editorial pick)1 loosely related (not mappings) |
| PCI DSS | 6.3.16.3.26.3.311.3.111.3.212.5.1 | Vulnerabilities identified and risk-ranked; Inventory of custom software and its components… | Editorial | Same topic: Vulnerability Mgmt, Patch Management, Asset Management (editorial pick)16 loosely related (not mappings)12.3.4 Hardware and software technologies reviewed annually Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping 12.8.1 List of third-party service providers kept Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping 6.2.1 Bespoke and custom software developed securely Only shares CSF ID.AM-08: related, not a mapping 6.2.2 Developers trained in secure software development Only shares CSF ID.AM-08: related, not a mapping 6.2.3.1 Manual code reviews approved by someone else Only shares CSF ID.AM-08: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Only shares CSF ID.AM-08: related, not a mapping …and 8 more in the downloads |
| CMMC | CM.L2-3.4.1RA.L2-3.11.2RA.L2-3.11.3SI.L2-3.14.1 | System Baselining; Vulnerability Scan… | Editorial | Same topic: Asset Management, Vulnerability Mgmt, Patch Management (editorial pick)15 loosely related (not mappings)…and 7 more in the downloads |
| 800-53 | CA-8CM-8PM-5RA-5SI-2 | Penetration Testing; System Component Inventory… | Editorial | Same topic: Vulnerability Mgmt, Asset Management, Patch Management (editorial pick)30 loosely related (not mappings)…and 22 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8)§164.310(d)§164.310(d)(2)(iii) | Risk Analysis; Risk Management… | Editorial | Same topic: Vulnerability Mgmt, Asset Management (editorial pick)20 loosely related (not mappings)§164.308(b)(4) Written Contract or Other Arrangement Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping …and 12 more in the downloads |
| GDPR | Art.30(1)Art.32(1)(d) | Records of processing activities; Security of processing | Editorial | Same topic: Asset Management, Vulnerability Mgmt (editorial pick)1 loosely related (not mappings) |
| NIS2 | 6.56.66.1012.4 | Security testing; Security patch management… | Editorial | Same topic: Vulnerability Mgmt, Patch Management, Asset Management (editorial pick) |
| Essential Eight | ISM-1501ISM-1691ISM-1693ISM-1695ISM-1698ISM-1699ISM-1701ISM-1702ISM-1704ISM-1807ISM-1808ISM-1876ISM-1877 | Operating systems that are no longer supported by vendors are replaced; Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release… | Editorial | Same topic: Patch Management, Vulnerability Mgmt, Asset Management (editorial pick)16 loosely related (not mappings)ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1696 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1697 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1700 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping …and 8 more in the downloads |
| DORA | Art.8(1)Art.8(2)Art.8(4)Art.8(6)Art.9(4)(f)Art.25(1)Art.26(1)Art.27(1) | Identification; Identification… | Editorial | Same topic: Asset Management, Vulnerability Mgmt, Patch Management (editorial pick) |
| CPS 234 | Para 17Para 20Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Classify information assets by criticality and sensitivity… | Editorial | Same topic: Vulnerability Mgmt, Asset Management (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.