Essential Eight · Patch applications
ISM-1699
A vulnerability scanner is used at least weekly to identify missing patches or updates…
frameworkASD Essential Eight
sectionPatch applications
levelsML1, ML2, ML3
csf 2.0ID.RA-01 ID.RA-08 PR.PS-02
topicsVulnerability Mgmt
frameworks0 13 0
Official textA vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01ID.RA-08 | Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Editorial | Same topic: Vulnerability Mgmt (editorial pick)1 loosely related (not mappings)PR.PS-02 Software is maintained, replaced, and removed commensurate with risk Only shares CSF PR.PS-02: related, not a mapping |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | Editorial | Same topic: Vulnerability Mgmt (editorial pick)3 loosely related (not mappings)A.5.9 Inventory of information and other associated assets Only shares CSF PR.PS-02: related, not a mapping |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)5 loosely related (not mappings)CIS 2.2 Ensure Authorized Software is Currently Supported Only shares CSF PR.PS-02: related, not a mapping CIS 7.3 Perform Automated Operating System Patch Management Only shares CSF PR.PS-02: related, not a mapping CIS 7.4 Perform Automated Application Patch Management Only shares CSF PR.PS-02: related, not a mapping CIS 12.1 Ensure Network Infrastructure is Up-to-Date Only shares CSF PR.PS-02: related, not a mapping |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| PCI DSS | 6.3.111.3.111.3.2 | Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)4 loosely related (not mappings)6.3.2 Inventory of custom software and its components Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF ID.RA-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF PR.PS-02: related, not a mapping |
| CMMC | RA.L2-3.11.2RA.L2-3.11.3 | Vulnerability Scan; Vulnerability Remediation | Editorial | Same topic: Vulnerability Mgmt (editorial pick)11 loosely related (not mappings)…and 3 more in the downloads |
| 800-53 | CA-8RA-5 | Penetration Testing; Vulnerability Monitoring and Scanning | Editorial | Same topic: Vulnerability Mgmt (editorial pick)12 loosely related (not mappings)…and 4 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Risk Analysis; Risk Management… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)6 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF ID.RA-01: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.PS-02: related, not a mapping |
| GDPR | Art.32(1)(d) | Security of processing | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| NIS2 | 6.56.10 | Security testing; Vulnerability handling and disclosure | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| DORA | Art.8(2)Art.25(1)Art.26(1)Art.27(1) | Identification; Testing of ICT tools and systems… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)1 loosely related (not mappings) |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness… | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.