NIS2 · 6. Security in acquisition, development and maintenance

Security testing

frameworkNIS2 Implementing Regulation (EU) 2024/2690 section6. Security in acquisition, development and maintenance csf 2.0ID.RA-01 topicsVulnerability Mgmt frameworks7 6 0

Official text · not licensableTitle from ENISA's guidance: Security testing. See the Annex to Implementing Regulation (EU) 2024/2690 for the legal text.

gap from NIS2 → gap to NIS2 →

Wrong or missing mapping? Report it

Equivalents of 6.5 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.RA-01 ID.RA-08	Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established	Crosswalk	Same topic: Vulnerability Mgmt
ISO 27001	A.8.8 A.8.29 A.8.33 A.8.34	Management of technical vulnerabilities; Security testing in development and acceptance…	Crosswalk	Same topic: Vulnerability Mgmt ENISA NIS2 → ISO 27001 mapping
CIS v8.1	CIS 7.1 CIS 7.2 CIS 7.5 CIS 7.6 CIS 7.7 CIS 16.6 CIS 18.1 CIS 18.2 CIS 18.3 CIS 18.4 CIS 18.5	Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process…	Crosswalk	Same topic: Vulnerability Mgmt
SOC 2	CC7.1	Detecting configuration changes and new vulnerabilities	Editorial	Same topic: Vulnerability Mgmt (editorial pick)
PCI DSS	6.3.1 11.3.1 11.3.2	Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months…	Crosswalk	Same topic: Vulnerability Mgmt 2 loosely related (not mappings) 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF ID.RA-01: related, not a mapping 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF ID.RA-01: related, not a mapping
CMMC	RA.L2-3.11.2 RA.L2-3.11.3	Vulnerability Scan; Vulnerability Remediation	Crosswalk	Same topic: Vulnerability Mgmt 7 loosely related (not mappings) CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF ID.RA-01: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF ID.RA-01: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF ID.RA-01: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF ID.RA-01: related, not a mapping SI.L2-3.14.3 Security Alerts & Advisories Loosely related Only shares CSF ID.RA-01: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF ID.RA-01: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF ID.RA-01: related, not a mapping
800-53	CA-8 RA-5	Penetration Testing; Vulnerability Monitoring and Scanning	Crosswalk	Same topic: Vulnerability Mgmt 7 loosely related (not mappings) CA-2 Control Assessments Loosely related Only shares CSF ID.RA-01: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF ID.RA-01: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF ID.RA-01: related, not a mapping SA-11 Developer Testing and Evaluation Loosely related Only shares CSF ID.RA-01: related, not a mapping SA-15 Development Process, Standards, and Tools Loosely related Only shares CSF ID.RA-01: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF ID.RA-01: related, not a mapping SI-5 Security Alerts, Advisories, and Directives Loosely related Only shares CSF ID.RA-01: related, not a mapping
HIPAA	§164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)	Evaluation; Risk Analysis…	Crosswalk	Same topic: Vulnerability Mgmt 3 loosely related (not mappings) §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF ID.RA-01: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF ID.RA-01: related, not a mapping §164.316(b) Documentation Loosely related Only shares CSF ID.RA-01: related, not a mapping
GDPR	Art.32(1)(d)	Security of processing	Editorial	Same topic: Vulnerability Mgmt (editorial pick)
Essential Eight	ISM-1698 ISM-1699 ISM-1701 ISM-1702 ISM-1807 ISM-1808	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…; A vulnerability scanner is used at least weekly to identify missing patches or updates……	Editorial	Same topic: Vulnerability Mgmt (editorial pick) 23 loosely related (not mappings) ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 15 more in the downloads
DORA	Art.8(2)Art.25(1)Art.26(1)Art.27(1)	Identification; Testing of ICT tools and systems…	Editorial	Same topic: Vulnerability Mgmt (editorial pick)
CPS 234	Para 17 Para 27 Para 30	Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness…	Editorial	Same topic: Vulnerability Mgmt (editorial pick)
Cyber Essentials	CE 3	Security Update Management	Editorial	Same topic: Vulnerability Mgmt (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.