Essential Eight · Patch operating systems
ISM-1903
Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release…
frameworkASD Essential Eight
sectionPatch operating systems
levelsML3
csf 2.0ID.RA-01 PR.PS-02 PR.PS-03
topics—
frameworks0 0 0
Official textPatches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01PR.PS-02PR.PS-03 | Vulnerabilities in assets are identified, validated, and recorded; Software is maintained, replaced, and removed commensurate with risk… | No mapping. Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISO 27001 | A.5.9A.8.1A.8.7A.8.8 | Inventory of information and other associated assets; User endpoint devices… | No mapping. Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping | |
| CIS v8.1 | CIS 1.2CIS 2.2CIS 2.3CIS 7.1 | Address Unauthorized Assets; Ensure Authorized Software is Currently Supported… | No mapping. Only shares CSF PR.PS-03, PR.PS-02, ID.RA-01: related, not a mapping+12 more loosely related (not mappings)CIS 7.3 Perform Automated Operating System Patch Management Only shares CSF PR.PS-02: related, not a mapping CIS 7.4 Perform Automated Application Patch Management Only shares CSF PR.PS-02: related, not a mapping CIS 7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets Only shares CSF ID.RA-01: related, not a mapping CIS 7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets Only shares CSF ID.RA-01: related, not a mapping …and 8 more in the downloads | |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| PCI DSS | 6.3.16.3.212.3.46.3.3 | Vulnerabilities identified and risk-ranked; Inventory of custom software and its components… | No mapping. Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| CMMC | CA.L2-3.12.1CA.L2-3.12.3CM.L2-3.4.9MA.L2-3.7.1 | Security Control Assessment; Security Control Monitoring… | No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping+9 more loosely related (not mappings)…and 5 more in the downloads | |
| 800-53 | SA-10CA-2CA-7CA-8 | Developer Configuration Management; Control Assessments… | No mapping. Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping+15 more loosely related (not mappings)…and 11 more in the downloads | |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)§164.308(a)(8) | Risk Analysis; Risk Management… | No mapping. Only shares CSF ID.RA-01: related, not a mapping+5 more loosely related (not mappings)§164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.PS-02: related, not a mapping …and 1 more in the downloads | |
| GDPR | Art.32(1)(d) | Security of processing | No mapping. Only shares CSF ID.RA-01: related, not a mapping | |
| NIS2 | 6.102.16.56.6 | Vulnerability handling and disclosure; Risk management framework… | No mapping. Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| DORA | Art.8(2)Art.9(4)(f)Art.25(1)Art.26(1) | Identification; Protection and prevention… | No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping+1 more loosely related (not mappings)Art.27(1) Requirements for testers for the carrying out of TLPT Only shares CSF ID.RA-01: related, not a mapping | |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness… | No mapping. Only shares CSF ID.RA-01: related, not a mapping | |
| Cyber Essentials | CE 3 | Security Update Management | No mapping. Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.