800-53 · SI System and Information Integrity
SI-2
Flaw Remediation
frameworkNIST SP 800-53 Rev 5.2
sectionSI System and Information Integrity
csf 2.0ID.IM-01 ID.IM-02 ID.IM-03 PR.PS-02
topicsPatch Management
frameworks6 4 2
Official texta. Identify, report, and correct system flaws;
b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
c. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates; and
d. Incorporate flaw remediation into the organizational configuration management process.NIST SP 800-53 Rev 5.2 control statement (public domain)
b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
c. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates; and
d. Incorporate flaw remediation into the organizational configuration management process.NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | Crosswalk | Same topic: Patch Management |
| ISO 27001 | A.8.8A.6.8A.8.32 | Management of technical vulnerabilities; Information security event reporting… | Crosswalk | Same topic: Patch Management NIST SP 800-53 → ISO 27001 mapping |
| CIS v8.1 | CIS 2.2CIS 7.3CIS 7.4CIS 12.1 | Ensure Authorized Software is Currently Supported; Perform Automated Operating System Patch Management… | Crosswalk | Same topic: Patch Management1 loosely related (not mappings) |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Patch Management (editorial pick) |
| PCI DSS | 6.3.16.3.3 | Vulnerabilities identified and risk-ranked; Security patches installed promptly | Crosswalk | Same topic: Patch Management |
| CMMC | SI.L2-3.14.1SI.L2-3.14.2SI.L2-3.14.3 | Flaw Remediation; Malicious Code Protection… | Crosswalk | Same topic: Patch Management NIST SP 800-171r2 Appendix D 3 loosely related (not mappings) |
| HIPAA | §164.312(c)§164.312(c)(2)§164.312(e)(2)(i) | Integrity; Mechanism to Authenticate Electronic Protected Health Information… | No mapping. Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.PS-02: related, not a mapping | |
| GDPR | — | No requirement | No mapping in our data | No mapping in our data (only GDPR's security articles are mapped, editorially). |
| NIS2 | 6.6 | Security patch management | Crosswalk | Same topic: Patch Management1 loosely related (not mappings) |
| Essential Eight | ISM-1501ISM-1691ISM-1693ISM-1695ISM-1704ISM-1876ISM-1877 | Operating systems that are no longer supported by vendors are replaced; Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release… | Editorial | Same topic: Patch Management (editorial pick)22 loosely related (not mappings)ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF PR.PS-02: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF PR.PS-02: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF PR.PS-02: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF PR.PS-02: related, not a mapping ISM-1696 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… Only shares CSF PR.PS-02: related, not a mapping ISM-1697 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… Only shares CSF PR.PS-02: related, not a mapping ISM-1698 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online… Only shares CSF PR.PS-02: related, not a mapping …and 14 more in the downloads |
| DORA | Art.9(4)(f) | Protection and prevention | Editorial | Same topic: Patch Management (editorial pick) |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Patch Management (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.