PCI DSS · Requirement 6: Develop and maintain secure systems and software
6.3.3
Security patches installed promptly
frameworkPCI DSS v4.0.1
sectionRequirement 6: Develop and maintain secure systems and software
csf 2.0GV.RM-03 GV.RM-06 GV.SC-09 ID.AM-08 ID.IM-03 ID.RA-05 ID.RA-06 PR.PS-02 RS.MI-02
topicsPatch Management
frameworks6 4 0
Official text · not licensableSummary (ControlMapping's wording): Security patches installed promptly. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | Crosswalk | Same topic: Patch Management7 loosely related (not mappings)GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes Only shares CSF GV.RM-03: related, not a mapping GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated Only shares CSF GV.RM-06: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Only shares CSF GV.SC-09: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Only shares CSF ID.AM-08: related, not a mapping ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization Only shares CSF ID.RA-05: related, not a mapping ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated Only shares CSF ID.RA-06: related, not a mapping |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | Crosswalk | Same topic: Patch Management19 loosely related (not mappings)Clause 6.1.2 Information security risk assessment Only shares CSF GV.RM-06, GV.SC-09, ID.RA-05: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF GV.RM-03, ID.RA-05, ID.RA-06: related, not a mapping A.5.9 Inventory of information and other associated assets Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF GV.SC-09, ID.AM-08: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Only shares CSF GV.SC-09, ID.AM-08: related, not a mapping …and 11 more in the downloads |
| CIS v8.1 | CIS 2.2CIS 7.3CIS 7.4CIS 12.1 | Ensure Authorized Software is Currently Supported; Perform Automated Operating System Patch Management… | Crosswalk | Same topic: Patch Management10 loosely related (not mappings)CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping …and 2 more in the downloads |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Patch Management (editorial pick)9 loosely related (not mappings)CC3.1 Objectives specified clearly enough to identify risks Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping CC3.3 Considering the potential for fraud Only shares CSF ID.RA-05, ID.RA-06: related, not a mapping CC3.4 Identifying and assessing significant changes Only shares CSF ID.RA-05, ID.RA-06: related, not a mapping CC5.1 Control activities that mitigate risks Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping CC9.1 Mitigating risks from business disruptions Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping CC6.1 Logical access security over information assets Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads |
| CMMC | SI.L2-3.14.1 | Flaw Remediation | Crosswalk | Same topic: Patch Management8 loosely related (not mappings)RA.L2-3.11.1 Risk Assessments Only shares CSF GV.RM-06, GV.SC-09, ID.IM-03, ID.RA-05: related, not a mapping |
| 800-53 | SI-2 | Flaw Remediation | Crosswalk | Same topic: Patch Management36 loosely related (not mappings)PM-9 Risk Management Strategy Only shares CSF GV.RM-03, GV.RM-06, GV.SC-09, ID.RA-06: related, not a mapping PM-30 Supply Chain Risk Management Strategy Only shares CSF GV.RM-03, GV.RM-06, GV.SC-09, ID.RA-06: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Only shares CSF GV.SC-09, ID.AM-08, ID.IM-03: related, not a mapping …and 28 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(B)§164.316(a)§164.308(a)(1)(ii)(A)§164.308(b)(4) | Risk Management; Policies and Procedures… | No mapping. Only shares CSF GV.RM-03, GV.RM-06, GV.SC-09, ID.AM-08…: related, not a mapping+20 more loosely related (not mappings)§164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF GV.SC-09, ID.AM-08, ID.IM-03: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF GV.SC-09, ID.AM-08, ID.IM-03: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF GV.SC-09, ID.AM-08, ID.IM-03: related, not a mapping §164.308(a)(6) Security Incident Procedures Only shares CSF ID.IM-03, RS.MI-02: related, not a mapping …and 16 more in the downloads | |
| GDPR | Art.24(1)Art.32(2)Art.35(1)Art.35(7) | Responsibility of the controller; Security of processing… | No mapping. Only shares CSF GV.RM-03, GV.RM-06, ID.RA-05, ID.RA-06: related, not a mapping | |
| NIS2 | 6.6 | Security patch management | Crosswalk | Same topic: Patch Management9 loosely related (not mappings)2.1 Risk management framework Only shares CSF GV.RM-03, GV.RM-06, ID.RA-05, ID.RA-06: related, not a mapping 6.10 Vulnerability handling and disclosure Only shares CSF ID.RA-05, ID.RA-06, PR.PS-02: related, not a mapping 1.1 Policy on the security of network and information systems Only shares CSF GV.RM-03: related, not a mapping 7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures Only shares CSF GV.RM-06: related, not a mapping …and 1 more in the downloads |
| Essential Eight | ISM-1501ISM-1691ISM-1693ISM-1695ISM-1704ISM-1876ISM-1877 | Operating systems that are no longer supported by vendors are replaced; Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release… | Editorial | Same topic: Patch Management (editorial pick)22 loosely related (not mappings)ISM-1807 An automated method of asset discovery is used at least fortnightly to support the… Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF PR.PS-02: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF PR.PS-02: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF PR.PS-02: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF PR.PS-02: related, not a mapping ISM-1696 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… Only shares CSF PR.PS-02: related, not a mapping ISM-1697 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… Only shares CSF PR.PS-02: related, not a mapping …and 14 more in the downloads |
| DORA | Art.9(4)(f) | Protection and prevention | Editorial | Same topic: Patch Management (editorial pick)16 loosely related (not mappings)Art.16(1) Simplified ICT risk management framework Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.24(1) General requirements for the performance of digital operational resilience testing Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping …and 8 more in the downloads |
| CPS 234 | Para 13Para 15Para 17Para 21 | Board ultimately responsible for information security; Maintain a capability commensurate with threats… | No mapping. Only shares CSF GV.RM-03, GV.RM-06, ID.RA-05, ID.RA-06: related, not a mapping+5 more loosely related (not mappings)Para 27 Systematic testing programme for control effectiveness Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 31 Review the testing programme at least annually Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 16 Assess third parties' information security capability Only shares CSF GV.SC-09: related, not a mapping Para 20 Classify information assets by criticality and sensitivity Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads | |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Patch Management (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.