식별 (ID) · 주제
취약점 관리
조직 자산의 취약점을 식별하고 관리합니다.
취약점 관리은 NIST CSF 2.0의 ID.RA-01 (Vulnerabilities in assets are identified, validated, and recorded); ID.RA-08 (Processes for receiving, analyzing, and responding to vulnerability disclosures are established) 결과들로 정의됩니다. 대응표 ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA 및 NIS2의 공개 크로스워크를 통해 매핑됨. 편집 콘텐츠 SOC 2, GDPR, Essential Eight, DORA, CPS 234 및 Cyber Essentials에 편집 방식으로 매핑됨.
| 프레임워크 | 요구사항 | 제목 | 링크 | 출처 / 사유 |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01ID.RA-08 | Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established | 주제 정의 | ID.RA-01 ID.RA-08 |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | 대응표 | A.8.8: via ID.RA-01; NIST 800-53 map: RA-5 |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process; Perform Automated Vulnerability Scans of Internal Enterprise Assets… | 대응표 | CIS 7.1: via ID.RA-01 CIS 7.2: via ID.RA-08 CIS 7.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): automated vulnerability scans of internal assets. CIS 7.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): automated vulnerability scans of external assets. CIS 7.7: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): remediate detected vulnerabilities. CIS 16.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): a severity rating process for application vulnerabilities. CIS 18.1: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): a penetration testing programme. CIS 18.2: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): periodic external penetration tests. CIS 18.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): remediate penetration test findings. CIS 18.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): validate security measures after penetration tests. CIS 18.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): periodic internal penetration tests. |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | 편집 콘텐츠 | CC7.1: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 6.3.111.3.111.3.2 | Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months; External ASV scans every three months | 대응표 | 6.3.1: via ID.RA-01 11.3.1: via ID.RA-01 11.3.2: via ID.RA-01 |
| CMMC | RA.L2-3.11.2RA.L2-3.11.3 | Vulnerability Scan; Vulnerability Remediation | 대응표 | RA.L2-3.11.2: via 800-171r3 03.11.02 ↔ ID.RA-01, ID.RA-08 → RA-5; 800-171r2 Appendix D → RA-5 RA.L2-3.11.3: via 800-171r3 03.11.02 ↔ ID.RA-01, ID.RA-08 → RA-5; 800-171r2 Appendix D → RA-5 |
| 800-53 | RA-5CA-8 | Vulnerability Monitoring and Scanning; Penetration Testing | 대응표 | RA-5: via ID.RA-01; ID.RA-08 CA-8: via ID.RA-01 |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Risk Analysis; Risk Management; Evaluation | 대응표 | §164.308(a)(1)(ii)(A): The HIPAA risk analysis must identify vulnerabilities to ePHI; HHS guidance treats vulnerability identification as part of it. §164.308(a)(1)(ii)(B): Risk management requires reducing identified risks and vulnerabilities to a reasonable level, which is where remediation sits in HIPAA. §164.308(a)(8): via NIST HIPAA map: CA-8 |
| GDPR | Art.32(1)(d) | Security of processing | 편집 콘텐츠 | Art.32(1)(d): No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 6.56.10 | Security testing; Vulnerability handling and disclosure | 대응표 | 6.5: via ID.RA-01 6.10: via ID.RA-01; ID.RA-08; ENISA ISO map: A.8.8 |
| Essential Eight | ISM-1807ISM-1808ISM-1698ISM-1699ISM-1701ISM-1702 | An automated method of asset discovery is used at least fortnightly to support the…; A vulnerability scanner with an up-to-date vulnerability database is used for…; A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…… | 편집 콘텐츠 | ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.8(2)Art.25(1)Art.26(1)Art.27(1) | Identification; Testing of ICT tools and systems; Advanced testing of ICT tools, systems and processes based on TLPT… | 편집 콘텐츠 | Art.8(2): Assess ICT vulnerabilities on a continuous basis. Art.25(1): Testing includes vulnerability assessments and scans, and penetration testing. Art.26(1): Entities selected by their authority run threat-led penetration testing (TLPT) at least every three years. Art.27(1): Testers carrying out TLPT must be suitable, technically capable, certified or bound by a code of conduct, and insured. |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness; Testing by skilled, functionally independent specialists | 편집 콘텐츠 | Para 17: Actively maintain the security capability as vulnerabilities change. Para 27: A systematic testing programme whose frequency follows how fast vulnerabilities and threats change. Para 30: Testing by appropriately skilled and functionally independent specialists. |
| Cyber Essentials | CE 3 | Security Update Management | 편집 콘텐츠 | CE 3: Fix known vulnerabilities: updates rated critical or high risk (CVSS v3 7 or above) within 14 days, and no unsupported software. |
주제 정의 이 주제를 정의하는 CSF 2.0 결과 · 대응표 공개된 크로스워크로 뒷받침되는 항목을 최소 하나 이상 선택 · 편집 콘텐츠 ControlMapping의 판단과 사유 · 매핑되지 않음, 이 주제의 CSF 성과만 공유함 · 보유 데이터에 매핑 없음 당사 데이터에 매핑된 항목이 없음. 대개 신규 작업이지만 적용 범위 안내를 확인하세요. 방법론.
요구사항 ID와 제목은 각 프레임워크가 발표한 그대로 영문으로 표시됩니다.
매핑이 잘못되었거나 누락되었나요? 신고하기
취약점 관리 소개
취약점 관리는 조직의 인프라, 애플리케이션, 엔드포인트 전반에 걸쳐 보안 약점을 발견하고, 우선순위를 정하고, 조치하는 지속적인 프로세스입니다. 효과적인 프로그램은 자동화된 스캔 도구로 취약점을 식별하고, 조치 노력을 집중하기 위해 위험 기반 우선순위 지정(CVSS 점수와 자산 중요도, 악용 가능성 여부를 결합하는 방식 등)을 활용하며, 패치 적용 일정에 대한 명확한 SLA를 정의합니다. 정기적인 취약점 진단과 침투 테스트를 통해 조치 활동이 효과적인지, 그리고 새로운 취약점이 신속하게 식별되고 있는지를 검증합니다.