Essential Eight · Patch applications & Patch operating systems
ISM-1808
A vulnerability scanner with an up-to-date vulnerability database is used for…
frameworkASD Essential Eight
sectionPatch applications & Patch operating systems
levelsML1, ML2, ML3
csf 2.0ID.RA-01 ID.RA-08 PR.PS-02 PR.PS-03
topicsVulnerability Mgmt
frameworks0 13 0
Official textA vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01ID.RA-08 | Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | Editorial | Same topic: Vulnerability Mgmt (editorial pick)4 loosely related (not mappings)A.5.9 Inventory of information and other associated assets Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)6 loosely related (not mappings)CIS 2.2 Ensure Authorized Software is Currently Supported Only shares CSF PR.PS-02: related, not a mapping CIS 7.3 Perform Automated Operating System Patch Management Only shares CSF PR.PS-02: related, not a mapping CIS 7.4 Perform Automated Application Patch Management Only shares CSF PR.PS-02: related, not a mapping CIS 12.1 Ensure Network Infrastructure is Up-to-Date Only shares CSF PR.PS-02: related, not a mapping |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| PCI DSS | 6.3.111.3.111.3.2 | Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)6 loosely related (not mappings)6.3.2 Inventory of custom software and its components Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping 9.4.7 Electronic media destroyed or made unrecoverable Only shares CSF PR.PS-03: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF ID.RA-01: related, not a mapping |
| CMMC | RA.L2-3.11.2RA.L2-3.11.3 | Vulnerability Scan; Vulnerability Remediation | Editorial | Same topic: Vulnerability Mgmt (editorial pick)11 loosely related (not mappings)…and 3 more in the downloads |
| 800-53 | CA-8RA-5 | Penetration Testing; Vulnerability Monitoring and Scanning | Editorial | Same topic: Vulnerability Mgmt (editorial pick)17 loosely related (not mappings)…and 9 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Risk Analysis; Risk Management… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)6 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF ID.RA-01: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.PS-02: related, not a mapping |
| GDPR | Art.32(1)(d) | Security of processing | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| NIS2 | 6.56.10 | Security testing; Vulnerability handling and disclosure | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| DORA | Art.8(2)Art.25(1)Art.26(1)Art.27(1) | Identification; Testing of ICT tools and systems… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)1 loosely related (not mappings) |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness… | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.