Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48…

frameworkASD Essential Eight sectionPatch applications levelsML3 csf 2.0ID.RA-01 PR.PS-02 topics— frameworks0 0 0

Official textPatches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0

gap from Essential Eight → gap to Essential Eight →

Wrong or missing mapping? Report it

Equivalents of ISM-1692 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.RA-01 PR.PS-02	Vulnerabilities in assets are identified, validated, and recorded; Software is maintained, replaced, and removed commensurate with risk	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping
ISO 27001	A.5.9 A.8.7 A.8.8	Inventory of information and other associated assets; Protection against malware…	Loosely related	No mapping. Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping
CIS v8.1	CIS 2.2 CIS 2.3 CIS 7.1 CIS 7.3	Ensure Authorized Software is Currently Supported; Address Unauthorized Software…	Loosely related	No mapping. Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping +11 more loosely related (not mappings) CIS 7.4 Perform Automated Application Patch Management Loosely related Only shares CSF PR.PS-02: related, not a mapping CIS 7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 7.7 Remediate Detected Vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 7 more in the downloads
SOC 2	CC7.1	Detecting configuration changes and new vulnerabilities	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping
PCI DSS	6.3.1 6.3.2 6.3.3 11.3.1	Vulnerabilities identified and risk-ranked; Inventory of custom software and its components…	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping +3 more loosely related (not mappings) 11.3.2 External ASV scans every three months Loosely related Only shares CSF ID.RA-01: related, not a mapping 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF ID.RA-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF PR.PS-02: related, not a mapping
CMMC	CA.L2-3.12.1 CA.L2-3.12.3 CM.L2-3.4.9 MA.L2-3.7.1	Security Control Assessment; Security Control Monitoring…	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping +9 more loosely related (not mappings) MA.L2-3.7.2 System Maintenance Control Loosely related Only shares CSF PR.PS-02: related, not a mapping MA.L2-3.7.4 Media Inspection Loosely related Only shares CSF PR.PS-02: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF ID.RA-01: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 5 more in the downloads
800-53	CA-2 CA-7 CA-8 CM-11	Control Assessments; Continuous Monitoring…	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping +10 more loosely related (not mappings) MA-3 Maintenance Tools Loosely related Only shares CSF PR.PS-02: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF ID.RA-01: related, not a mapping RA-5 Vulnerability Monitoring and Scanning Loosely related Only shares CSF ID.RA-01: related, not a mapping SA-10 Developer Configuration Management Loosely related Only shares CSF PR.PS-02: related, not a mapping …and 6 more in the downloads
HIPAA	§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)§164.308(a)(8)	Risk Analysis; Risk Management…	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping +5 more loosely related (not mappings) §164.312(c) Integrity Loosely related Only shares CSF PR.PS-02: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Loosely related Only shares CSF PR.PS-02: related, not a mapping §164.312(e)(2)(i) Integrity Controls Loosely related Only shares CSF PR.PS-02: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 1 more in the downloads
GDPR	Art.32(1)(d)	Security of processing	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping
NIS2	6.10 2.1 6.5 6.6	Vulnerability handling and disclosure; Risk management framework…	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping
DORA	Art.8(2)Art.9(4)(f)Art.25(1)Art.26(1)	Identification; Protection and prevention…	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping +1 more loosely related (not mappings) Art.27(1) Requirements for testers for the carrying out of TLPT Loosely related Only shares CSF ID.RA-01: related, not a mapping
CPS 234	Para 17 Para 27 Para 30	Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness…	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.