Essential Eight · Patch operating systems
ISM-1501
Operating systems that are no longer supported by vendors are replaced
frameworkASD Essential Eight
sectionPatch operating systems
levelsML1, ML2, ML3
csf 2.0ID.RA-01 PR.PS-02 PR.PS-03
topicsPatch Management
frameworks0 10 0
Official textOperating systems that are no longer supported by vendors are replaced.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | Editorial | Same topic: Patch Management (editorial pick) |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | Editorial | Same topic: Patch Management (editorial pick)3 loosely related (not mappings)A.5.9 Inventory of information and other associated assets Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping |
| CIS v8.1 | CIS 2.2CIS 7.3CIS 7.4CIS 12.1 | Ensure Authorized Software is Currently Supported; Perform Automated Operating System Patch Management… | Editorial | Same topic: Patch Management (editorial pick)12 loosely related (not mappings)CIS 7.1 Establish and Maintain a Vulnerability Management Process Only shares CSF ID.RA-01: related, not a mapping CIS 7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets Only shares CSF ID.RA-01: related, not a mapping CIS 7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets Only shares CSF ID.RA-01: related, not a mapping CIS 16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities Only shares CSF ID.RA-01: related, not a mapping CIS 18.1 Establish and Maintain a Penetration Testing Program Only shares CSF ID.RA-01: related, not a mapping …and 4 more in the downloads |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Patch Management (editorial pick) |
| PCI DSS | 6.3.16.3.3 | Vulnerabilities identified and risk-ranked; Security patches installed promptly | Editorial | Same topic: Patch Management (editorial pick)7 loosely related (not mappings)6.3.2 Inventory of custom software and its components Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping 9.4.7 Electronic media destroyed or made unrecoverable Only shares CSF PR.PS-03: related, not a mapping 11.3.1 Internal vulnerability scans every three months Only shares CSF ID.RA-01: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF ID.RA-01: related, not a mapping |
| CMMC | SI.L2-3.14.1 | Flaw Remediation | Editorial | Same topic: Patch Management (editorial pick)12 loosely related (not mappings)…and 4 more in the downloads |
| 800-53 | SI-2 | Flaw Remediation | Editorial | Same topic: Patch Management (editorial pick)18 loosely related (not mappings)…and 10 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)§164.308(a)(8) | Risk Analysis; Risk Management… | No mapping. Only shares CSF ID.RA-01: related, not a mapping+5 more loosely related (not mappings)§164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.PS-02: related, not a mapping …and 1 more in the downloads | |
| GDPR | Art.32(1)(d) | Security of processing | No mapping. Only shares CSF ID.RA-01: related, not a mapping | |
| NIS2 | 6.6 | Security patch management | Editorial | Same topic: Patch Management (editorial pick) |
| DORA | Art.9(4)(f) | Protection and prevention | Editorial | Same topic: Patch Management (editorial pick) |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness… | No mapping. Only shares CSF ID.RA-01: related, not a mapping | |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Patch Management (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.