Essential Eight · Patch operating systems
ISM-1697
Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release…
frameworkASD Essential Eight
sectionPatch operating systems
levelsML3
csf 2.0ID.RA-01 PR.PS-02 PR.PS-03
topics—
frameworks0 0 0
Official textPatches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01PR.PS-02PR.PS-03 | Vulnerabilities in assets are identified, validated, and recorded; Software is maintained, replaced, and removed commensurate with risk… | No mapping. Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISO 27001 | A.5.9A.8.1A.8.7A.8.8 | Inventory of information and other associated assets; User endpoint devices… | No mapping. Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping | |
| CIS v8.1 | CIS 1.2CIS 2.2CIS 2.3CIS 7.1 | Address Unauthorized Assets; Ensure Authorized Software is Currently Supported… | No mapping. Only shares CSF PR.PS-03, PR.PS-02, ID.RA-01: related, not a mapping+12 more loosely related (not mappings)CIS 7.3 Perform Automated Operating System Patch Management Only shares CSF PR.PS-02: related, not a mapping CIS 7.4 Perform Automated Application Patch Management Only shares CSF PR.PS-02: related, not a mapping CIS 7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets Only shares CSF ID.RA-01: related, not a mapping CIS 7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets Only shares CSF ID.RA-01: related, not a mapping …and 8 more in the downloads | |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| PCI DSS | 6.3.16.3.212.3.46.3.3 | Vulnerabilities identified and risk-ranked; Inventory of custom software and its components… | No mapping. Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| CMMC | CA.L2-3.12.1CA.L2-3.12.3CM.L2-3.4.9MA.L2-3.7.1 | Security Control Assessment; Security Control Monitoring… | No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping+9 more loosely related (not mappings)…and 5 more in the downloads | |
| 800-53 | SA-10CA-2CA-7CA-8 | Developer Configuration Management; Control Assessments… | No mapping. Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping+15 more loosely related (not mappings)…and 11 more in the downloads | |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)§164.308(a)(8) | Risk Analysis; Risk Management… | No mapping. Only shares CSF ID.RA-01: related, not a mapping+5 more loosely related (not mappings)§164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.PS-02: related, not a mapping …and 1 more in the downloads | |
| GDPR | Art.32(1)(d) | Security of processing | No mapping. Only shares CSF ID.RA-01: related, not a mapping | |
| NIS2 | 6.102.16.56.6 | Vulnerability handling and disclosure; Risk management framework… | No mapping. Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| DORA | Art.8(2)Art.9(4)(f)Art.25(1)Art.26(1) | Identification; Protection and prevention… | No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping+1 more loosely related (not mappings)Art.27(1) Requirements for testers for the carrying out of TLPT Only shares CSF ID.RA-01: related, not a mapping | |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness… | No mapping. Only shares CSF ID.RA-01: related, not a mapping | |
| Cyber Essentials | CE 3 | Security Update Management | No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.