識別 (ID) · トピック
脆弱性管理
組織の資産に存在する脆弱性を特定し、管理します。
脆弱性管理 は NIST CSF 2.0 のアウトカム ID.RA-01 (Vulnerabilities in assets are identified, validated, and recorded); ID.RA-08 (Processes for receiving, analyzing, and responding to vulnerability disclosures are established) で定義されています。 対応表 ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA および NIS2 において、公開されたクロスウォークを通じてマッピング済み。 編集 SOC 2, GDPR, Essential Eight, DORA, CPS 234 および Cyber Essentials において編集上マッピング済み。
| フレームワーク | 要件 | タイトル | リンク | 出典／理由 |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01ID.RA-08 | Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established | トピックの定義 | ID.RA-01 ID.RA-08 |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | 対応表 | A.8.8: via ID.RA-01; NIST 800-53 map: RA-5 |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process; Perform Automated Vulnerability Scans of Internal Enterprise Assets… | 対応表 | CIS 7.1: via ID.RA-01 CIS 7.2: via ID.RA-08 CIS 7.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): automated vulnerability scans of internal assets. CIS 7.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): automated vulnerability scans of external assets. CIS 7.7: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): remediate detected vulnerabilities. CIS 16.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): a severity rating process for application vulnerabilities. CIS 18.1: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): a penetration testing programme. CIS 18.2: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): periodic external penetration tests. CIS 18.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): remediate penetration test findings. CIS 18.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): validate security measures after penetration tests. CIS 18.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): periodic internal penetration tests. |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | 編集 | CC7.1: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 6.3.111.3.111.3.2 | Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months; External ASV scans every three months | 対応表 | 6.3.1: via ID.RA-01 11.3.1: via ID.RA-01 11.3.2: via ID.RA-01 |
| CMMC | RA.L2-3.11.2RA.L2-3.11.3 | Vulnerability Scan; Vulnerability Remediation | 対応表 | RA.L2-3.11.2: via 800-171r3 03.11.02 ↔ ID.RA-01, ID.RA-08 → RA-5; 800-171r2 Appendix D → RA-5 RA.L2-3.11.3: via 800-171r3 03.11.02 ↔ ID.RA-01, ID.RA-08 → RA-5; 800-171r2 Appendix D → RA-5 |
| 800-53 | RA-5CA-8 | Vulnerability Monitoring and Scanning; Penetration Testing | 対応表 | RA-5: via ID.RA-01; ID.RA-08 CA-8: via ID.RA-01 |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Risk Analysis; Risk Management; Evaluation | 対応表 | §164.308(a)(1)(ii)(A): The HIPAA risk analysis must identify vulnerabilities to ePHI; HHS guidance treats vulnerability identification as part of it. §164.308(a)(1)(ii)(B): Risk management requires reducing identified risks and vulnerabilities to a reasonable level, which is where remediation sits in HIPAA. §164.308(a)(8): via NIST HIPAA map: CA-8 |
| GDPR | Art.32(1)(d) | Security of processing | 編集 | Art.32(1)(d): No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 6.56.10 | Security testing; Vulnerability handling and disclosure | 対応表 | 6.5: via ID.RA-01 6.10: via ID.RA-01; ID.RA-08; ENISA ISO map: A.8.8 |
| Essential Eight | ISM-1807ISM-1808ISM-1698ISM-1699ISM-1701ISM-1702 | An automated method of asset discovery is used at least fortnightly to support the…; A vulnerability scanner with an up-to-date vulnerability database is used for…; A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…… | 編集 | ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.8(2)Art.25(1)Art.26(1)Art.27(1) | Identification; Testing of ICT tools and systems; Advanced testing of ICT tools, systems and processes based on TLPT… | 編集 | Art.8(2): Assess ICT vulnerabilities on a continuous basis. Art.25(1): Testing includes vulnerability assessments and scans, and penetration testing. Art.26(1): Entities selected by their authority run threat-led penetration testing (TLPT) at least every three years. Art.27(1): Testers carrying out TLPT must be suitable, technically capable, certified or bound by a code of conduct, and insured. |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness; Testing by skilled, functionally independent specialists | 編集 | Para 17: Actively maintain the security capability as vulnerabilities change. Para 27: A systematic testing programme whose frequency follows how fast vulnerabilities and threats change. Para 30: Testing by appropriately skilled and functionally independent specialists. |
| Cyber Essentials | CE 3 | Security Update Management | 編集 | CE 3: Fix known vulnerabilities: updates rated critical or high risk (CVSS v3 7 or above) within 14 days, and no unsupported software. |
トピックの定義 このトピックを定義するCSF 2.0 のアウトカム · 対応表 公開されたクロスウォークに裏付けられた項目を少なくとも1つ選択 · 編集 ControlMapping の判断（理由付き） · マッピングはされていないが、このトピックのCSFアウトカムを共有しています · 当サイトのデータにはマッピングがありません 当サイトのデータではマッピングされていません。新規の取り組みであることが多いですが、カバレッジに関する注記を確認してください. 方法論.
要件 ID とタイトルは、各フレームワークが公開している英語の表記のまま表示しています。
マッピングに誤りや欠落がありますか？ 報告する
脆弱性管理について
脆弱性管理とは、組織のインフラストラクチャ、アプリケーション、エンドポイント全体にわたるセキュリティ上の弱点を発見、優先順位付け、修復する継続的なプロセスです。実効性のあるプログラムでは、自動化されたスキャンツールで脆弱性を特定し、リスクベースの優先順位付け（CVSSスコアに資産の重要度と悪用可能性を組み合わせた方法など）により修復作業の焦点を定め、パッチ適用のタイムラインとして定義されたSLAを用います。定期的な脆弱性評価およびペネトレーションテストにより、修復作業が有効であること、また新たな脆弱性が迅速に特定されていることを検証します。