Hardware is maintained, replaced, and removed commensurate with risk

frameworkNIST Cybersecurity Framework 2.0 sectionProtect (PR) topics— frameworks0 0 7

gap from NIST CSF 2.0 → gap to NIST CSF 2.0 →

Wrong or missing mapping? Report it

Equivalents of PR.PS-03 in other frameworks
Framework	Requirement	Title	Link	Source / reason
ISO 27001	A.5.9 A.8.1	Inventory of information and other associated assets; User endpoint devices	Loosely related	No mapping. Only shares CSF PR.PS-03: related, not a mapping
CIS v8.1	CIS 1.2	Address Unauthorized Assets	Loosely related	No mapping. Only shares CSF PR.PS-03: related, not a mapping
SOC 2	—	No requirement	No mapping in our data	No mapping in our data (SOC 2 links are editorial only).
PCI DSS	9.4.7 9.5.1.1 12.3.4	Electronic media destroyed or made unrecoverable; Inventory of POI devices kept…	Loosely related	No mapping. Only shares CSF PR.PS-03: related, not a mapping
CMMC	—	No requirement	No mapping in our data	No mapping in our data.
800-53	CM-7 SA-10 SC-3 SC-39	Least Functionality; Developer Configuration Management…	Loosely related	No mapping. Only shares CSF PR.PS-03: related, not a mapping +2 more loosely related (not mappings) SC-49 Hardware-enforced Separation and Policy Enforcement Loosely related Only shares CSF PR.PS-03: related, not a mapping SC-51 Hardware-based Protection Loosely related Only shares CSF PR.PS-03: related, not a mapping
HIPAA	—	No requirement	No mapping in our data	No mapping in our data.
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	6.10	Vulnerability handling and disclosure	Loosely related	No mapping. Only shares CSF PR.PS-03: related, not a mapping
Essential Eight	ISM-1407 ISM-1501 ISM-1694 ISM-1695	The latest release, or the previous release, of operating systems are used; Operating systems that are no longer supported by vendors are replaced…	Loosely related	No mapping. Only shares CSF PR.PS-03: related, not a mapping +13 more loosely related (not mappings) ISM-1696 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… Loosely related Only shares CSF PR.PS-03: related, not a mapping ISM-1697 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… Loosely related Only shares CSF PR.PS-03: related, not a mapping ISM-1701 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in… Loosely related Only shares CSF PR.PS-03: related, not a mapping ISM-1702 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of… Loosely related Only shares CSF PR.PS-03: related, not a mapping …and 9 more in the downloads
DORA	—	No requirement	No mapping in our data	No mapping in our data (DORA links are editorial, and its technical standards are not mapped).
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.