Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of…

frameworkASD Essential Eight sectionPatch applications levelsML1, ML2, ML3 csf 2.0ID.RA-01 PR.PS-02 topics— frameworks0 0 0

Official textPatches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0

gap from Essential Eight → gap to Essential Eight →

Wrong or missing mapping? Report it

Equivalents of ISM-1690 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.RA-01 PR.PS-02	Vulnerabilities in assets are identified, validated, and recorded; Software is maintained, replaced, and removed commensurate with risk	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping
ISO 27001	A.5.9 A.8.7 A.8.8	Inventory of information and other associated assets; Protection against malware…	Loosely related	No mapping. Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping
CIS v8.1	CIS 2.2 CIS 2.3 CIS 7.1 CIS 7.3	Ensure Authorized Software is Currently Supported; Address Unauthorized Software…	Loosely related	No mapping. Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping +11 more loosely related (not mappings) CIS 7.4 Perform Automated Application Patch Management Loosely related Only shares CSF PR.PS-02: related, not a mapping CIS 7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 7.7 Remediate Detected Vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 7 more in the downloads
SOC 2	CC7.1	Detecting configuration changes and new vulnerabilities	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping
PCI DSS	6.3.1 6.3.2 6.3.3 11.3.1	Vulnerabilities identified and risk-ranked; Inventory of custom software and its components…	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping +3 more loosely related (not mappings) 11.3.2 External ASV scans every three months Loosely related Only shares CSF ID.RA-01: related, not a mapping 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF ID.RA-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF PR.PS-02: related, not a mapping
CMMC	CA.L2-3.12.1 CA.L2-3.12.3 CM.L2-3.4.9 MA.L2-3.7.1	Security Control Assessment; Security Control Monitoring…	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping +9 more loosely related (not mappings) MA.L2-3.7.2 System Maintenance Control Loosely related Only shares CSF PR.PS-02: related, not a mapping MA.L2-3.7.4 Media Inspection Loosely related Only shares CSF PR.PS-02: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF ID.RA-01: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 5 more in the downloads
800-53	CA-2 CA-7 CA-8 CM-11	Control Assessments; Continuous Monitoring…	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping +10 more loosely related (not mappings) MA-3 Maintenance Tools Loosely related Only shares CSF PR.PS-02: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF ID.RA-01: related, not a mapping RA-5 Vulnerability Monitoring and Scanning Loosely related Only shares CSF ID.RA-01: related, not a mapping SA-10 Developer Configuration Management Loosely related Only shares CSF PR.PS-02: related, not a mapping …and 6 more in the downloads
HIPAA	§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)§164.308(a)(8)	Risk Analysis; Risk Management…	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping +5 more loosely related (not mappings) §164.312(c) Integrity Loosely related Only shares CSF PR.PS-02: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Loosely related Only shares CSF PR.PS-02: related, not a mapping §164.312(e)(2)(i) Integrity Controls Loosely related Only shares CSF PR.PS-02: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 1 more in the downloads
GDPR	Art.32(1)(d)	Security of processing	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping
NIS2	6.10 2.1 6.5 6.6	Vulnerability handling and disclosure; Risk management framework…	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping
DORA	Art.8(2)Art.9(4)(f)Art.25(1)Art.26(1)	Identification; Protection and prevention…	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping +1 more loosely related (not mappings) Art.27(1) Requirements for testers for the carrying out of TLPT Loosely related Only shares CSF ID.RA-01: related, not a mapping
CPS 234	Para 17 Para 27 Para 30	Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness…	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.