NIS2 · 6. Security in acquisition, development and maintenance
6.10
Vulnerability handling and disclosure
frameworkNIS2 Implementing Regulation (EU) 2024/2690
section6. Security in acquisition, development and maintenance
csf 2.0ID.RA-01 ID.RA-02 ID.RA-04 ID.RA-05 ID.RA-06 ID.RA-08 PR.PS-02 PR.PS-03
topicsVulnerability Mgmt
frameworks7 6 0
Official text · not licensableTitle from ENISA's guidance: Vulnerability handling and disclosure. See the Annex to Implementing Regulation (EU) 2024/2690 for the legal text.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01ID.RA-08 | Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Crosswalk | Same topic: Vulnerability Mgmt6 loosely related (not mappings)ID.RA-02 Cyber threat intelligence is received from information sharing forums and sources Only shares CSF ID.RA-02: related, not a mapping ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded Only shares CSF ID.RA-04: related, not a mapping ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization Only shares CSF ID.RA-05: related, not a mapping ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated Only shares CSF ID.RA-06: related, not a mapping PR.PS-02 Software is maintained, replaced, and removed commensurate with risk Only shares CSF PR.PS-02: related, not a mapping PR.PS-03 Hardware is maintained, replaced, and removed commensurate with risk Only shares CSF PR.PS-03: related, not a mapping |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | Crosswalk | Same topic: Vulnerability Mgmt9 loosely related (not mappings)Clause 6.1.2 Information security risk assessment Only shares CSF ID.RA-04, ID.RA-05, ID.RA-08: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF ID.RA-04, ID.RA-05, ID.RA-06: related, not a mapping A.5.9 Inventory of information and other associated assets Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Only shares CSF ID.RA-02: related, not a mapping …and 1 more in the downloads |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process… | Crosswalk | Same topic: Vulnerability Mgmt6 loosely related (not mappings)CIS 2.2 Ensure Authorized Software is Currently Supported Only shares CSF PR.PS-02: related, not a mapping CIS 7.3 Perform Automated Operating System Patch Management Only shares CSF PR.PS-02: related, not a mapping CIS 7.4 Perform Automated Application Patch Management Only shares CSF PR.PS-02: related, not a mapping CIS 12.1 Ensure Network Infrastructure is Up-to-Date Only shares CSF PR.PS-02: related, not a mapping |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Vulnerability Mgmt (editorial pick)3 loosely related (not mappings)CC3.2 Risk identification and analysis Only shares CSF ID.RA-04, ID.RA-05, ID.RA-06: related, not a mapping CC3.3 Considering the potential for fraud Only shares CSF ID.RA-04, ID.RA-05, ID.RA-06: related, not a mapping CC3.4 Identifying and assessing significant changes Only shares CSF ID.RA-04, ID.RA-05, ID.RA-06: related, not a mapping |
| PCI DSS | 6.3.111.3.111.3.2 | Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months… | Crosswalk | Same topic: Vulnerability Mgmt9 loosely related (not mappings)6.3.3 Security patches installed promptly Only shares CSF ID.RA-05, ID.RA-06, PR.PS-02: related, not a mapping 6.3.2 Inventory of custom software and its components Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping 12.3.1 Targeted risk analysis for flexible-frequency requirements Only shares CSF ID.RA-04, ID.RA-05: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping 9.4.7 Electronic media destroyed or made unrecoverable Only shares CSF PR.PS-03: related, not a mapping 11.3.1.1 Lower-ranked vulnerabilities handled by risk analysis Only shares CSF ID.RA-05: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF ID.RA-01: related, not a mapping …and 1 more in the downloads |
| CMMC | RA.L2-3.11.2RA.L2-3.11.3 | Vulnerability Scan; Vulnerability Remediation | Crosswalk | Same topic: Vulnerability Mgmt11 loosely related (not mappings)RA.L2-3.11.1 Risk Assessments Only shares CSF ID.RA-01, ID.RA-02, ID.RA-04, ID.RA-05: related, not a mapping …and 3 more in the downloads |
| 800-53 | CA-8RA-5 | Penetration Testing; Vulnerability Monitoring and Scanning | Crosswalk | Same topic: Vulnerability Mgmt27 loosely related (not mappings)SI-5 Security Alerts, Advisories, and Directives Only shares CSF ID.RA-01, ID.RA-02: related, not a mapping …and 19 more in the downloads |
| HIPAA | §164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B) | Evaluation; Risk Analysis… | Crosswalk | Same topic: Vulnerability Mgmt7 loosely related (not mappings)§164.316(a) Policies and Procedures Only shares CSF ID.RA-01, ID.RA-04, ID.RA-05: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF ID.RA-04, ID.RA-05: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF ID.RA-01: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.PS-02: related, not a mapping |
| GDPR | Art.32(1)(d) | Security of processing | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| Essential Eight | ISM-1698ISM-1699ISM-1701ISM-1702ISM-1807ISM-1808 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…; A vulnerability scanner is used at least weekly to identify missing patches or updates…… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)23 loosely related (not mappings)ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping ISM-1695 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping ISM-1696 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping ISM-1697 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping ISM-1703 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping ISM-1877 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours… Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping …and 15 more in the downloads |
| DORA | Art.8(2)Art.25(1)Art.26(1)Art.27(1) | Identification; Testing of ICT tools and systems… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)5 loosely related (not mappings)Art.45(1) Information-sharing arrangements on cyber threat information and intelligence Only shares CSF ID.RA-02: related, not a mapping |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)1 loosely related (not mappings)Para 21 Timely controls commensurate with risk and asset life-cycle Only shares CSF ID.RA-04, ID.RA-05, ID.RA-06: related, not a mapping |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.