NIST CSF 2.0 · Protect (PR)
PR.PS-02
Software is maintained, replaced, and removed commensurate with risk
frameworkNIST Cybersecurity Framework 2.0
sectionProtect (PR)
topicsPatch Management
frameworks6 4 2
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | Crosswalk | Same topic: Patch Management |
| CIS v8.1 | CIS 2.2CIS 7.3CIS 7.4CIS 12.1 | Ensure Authorized Software is Currently Supported; Perform Automated Operating System Patch Management… | Crosswalk | Same topic: Patch Management1 loosely related (not mappings) |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Patch Management (editorial pick) |
| PCI DSS | 6.3.16.3.3 | Vulnerabilities identified and risk-ranked; Security patches installed promptly | Crosswalk | Same topic: Patch Management |
| CMMC | SI.L2-3.14.1 | Flaw Remediation | Crosswalk | Same topic: Patch Management3 loosely related (not mappings) |
| 800-53 | SI-2 | Flaw Remediation | Crosswalk | Same topic: Patch Management4 loosely related (not mappings) |
| HIPAA | §164.312(c)§164.312(c)(2)§164.312(e)(2)(i) | Integrity; Mechanism to Authenticate Electronic Protected Health Information… | No mapping. Only shares CSF PR.PS-02: related, not a mapping | |
| GDPR | — | No requirement | No mapping in our data | No mapping in our data (only GDPR's security articles are mapped, editorially). |
| NIS2 | 6.6 | Security patch management | Crosswalk | Same topic: Patch Management1 loosely related (not mappings) |
| Essential Eight | ISM-1501ISM-1691ISM-1693ISM-1695ISM-1704ISM-1876ISM-1877 | Operating systems that are no longer supported by vendors are replaced; Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release… | Editorial | Same topic: Patch Management (editorial pick)22 loosely related (not mappings)ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF PR.PS-02: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF PR.PS-02: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF PR.PS-02: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF PR.PS-02: related, not a mapping ISM-1696 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… Only shares CSF PR.PS-02: related, not a mapping ISM-1697 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… Only shares CSF PR.PS-02: related, not a mapping ISM-1698 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online… Only shares CSF PR.PS-02: related, not a mapping …and 14 more in the downloads |
| DORA | Art.9(4)(f) | Protection and prevention | Editorial | Same topic: Patch Management (editorial pick) |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Patch Management (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.