Maintenance Tools

frameworkNIST SP 800-53 Rev 5.2 sectionMA Maintenance csf 2.0PR.PS-02 topics— frameworks2 0 2

Official texta. Approve, control, and monitor the use of system maintenance tools; and
b. Review previously approved system maintenance tools [Assignment: organization-defined frequency].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of MA-3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.PS-02	Software is maintained, replaced, and removed commensurate with risk	Loosely related	No mapping. Only shares CSF PR.PS-02: related, not a mapping
ISO 27001	A.8.10	Information deletion	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 2 loosely related (not mappings) A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF PR.PS-02: related, not a mapping A.8.7 Protection against malware Loosely related Only shares CSF PR.PS-02: related, not a mapping
CIS v8.1	CIS 2.2 CIS 2.3 CIS 7.3 CIS 7.4	Ensure Authorized Software is Currently Supported; Address Unauthorized Software…	Loosely related	No mapping. Only shares CSF PR.PS-02: related, not a mapping +1 more loosely related (not mappings) CIS 12.1 Ensure Network Infrastructure is Up-to-Date Loosely related Only shares CSF PR.PS-02: related, not a mapping
SOC 2	CC7.1	Detecting configuration changes and new vulnerabilities	Loosely related	No mapping. Only shares CSF PR.PS-02: related, not a mapping
PCI DSS	6.3.1 6.3.2 6.3.3 12.3.4	Vulnerabilities identified and risk-ranked; Inventory of custom software and its components…	Loosely related	No mapping. Only shares CSF PR.PS-02: related, not a mapping
CMMC	MA.L2-3.7.1 MA.L2-3.7.2 MA.L2-3.7.4	Perform Maintenance; System Maintenance Control…	Crosswalk	NIST SP 800-171r2 Appendix D; NIST SP 800-171r3 03.07.04 → SP 800-53 1 loosely related (not mappings) SI.L2-3.14.1 Flaw Remediation Loosely related Only shares CSF PR.PS-02: related, not a mapping
HIPAA	§164.312(c)§164.312(c)(2)§164.312(e)(2)(i)	Integrity; Mechanism to Authenticate Electronic Protected Health Information…	Loosely related	No mapping. Only shares CSF PR.PS-02: related, not a mapping
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	6.6 6.10	Security patch management; Vulnerability handling and disclosure	Loosely related	No mapping. Only shares CSF PR.PS-02: related, not a mapping
Essential Eight	ISM-0304 ISM-1407 ISM-1501 ISM-1690	Applications other than office productivity suites, web browsers and their extensions…; The latest release, or the previous release, of operating systems are used…	Loosely related	No mapping. Only shares CSF PR.PS-02: related, not a mapping +25 more loosely related (not mappings) ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Loosely related Only shares CSF PR.PS-02: related, not a mapping …and 21 more in the downloads
DORA	Art.9(4)(f)	Protection and prevention	Loosely related	No mapping. Only shares CSF PR.PS-02: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF PR.PS-02: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.