Essential Eight · Patch applications
ISM-1691
Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release
frameworkASD Essential Eight
sectionPatch applications
levelsML1, ML2
csf 2.0ID.RA-01 PR.PS-02
topicsPatch Management
frameworks0 10 0
Official textPatches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | Editorial | Same topic: Patch Management (editorial pick)1 loosely related (not mappings)ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded Only shares CSF ID.RA-01: related, not a mapping |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | Editorial | Same topic: Patch Management (editorial pick) |
| CIS v8.1 | CIS 2.2CIS 7.3CIS 7.4CIS 12.1 | Ensure Authorized Software is Currently Supported; Perform Automated Operating System Patch Management… | Editorial | Same topic: Patch Management (editorial pick)11 loosely related (not mappings)CIS 7.1 Establish and Maintain a Vulnerability Management Process Only shares CSF ID.RA-01: related, not a mapping CIS 7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets Only shares CSF ID.RA-01: related, not a mapping CIS 7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets Only shares CSF ID.RA-01: related, not a mapping CIS 16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities Only shares CSF ID.RA-01: related, not a mapping CIS 18.1 Establish and Maintain a Penetration Testing Program Only shares CSF ID.RA-01: related, not a mapping CIS 18.2 Perform Periodic External Penetration Tests Only shares CSF ID.RA-01: related, not a mapping …and 3 more in the downloads |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Patch Management (editorial pick) |
| PCI DSS | 6.3.16.3.3 | Vulnerabilities identified and risk-ranked; Security patches installed promptly | Editorial | Same topic: Patch Management (editorial pick)5 loosely related (not mappings)6.3.2 Inventory of custom software and its components Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping 11.3.1 Internal vulnerability scans every three months Only shares CSF ID.RA-01: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF ID.RA-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF PR.PS-02: related, not a mapping |
| CMMC | SI.L2-3.14.1 | Flaw Remediation | Editorial | Same topic: Patch Management (editorial pick)12 loosely related (not mappings)…and 4 more in the downloads |
| 800-53 | SI-2 | Flaw Remediation | Editorial | Same topic: Patch Management (editorial pick)13 loosely related (not mappings)…and 5 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)§164.308(a)(8) | Risk Analysis; Risk Management… | No mapping. Only shares CSF ID.RA-01: related, not a mapping+5 more loosely related (not mappings)§164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.PS-02: related, not a mapping …and 1 more in the downloads | |
| GDPR | Art.32(1)(d) | Security of processing | No mapping. Only shares CSF ID.RA-01: related, not a mapping | |
| NIS2 | 6.6 | Security patch management | Editorial | Same topic: Patch Management (editorial pick) |
| DORA | Art.9(4)(f) | Protection and prevention | Editorial | Same topic: Patch Management (editorial pick) |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness… | No mapping. Only shares CSF ID.RA-01: related, not a mapping | |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Patch Management (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.