保护 (PR) · 主题
补丁管理
确保系统和软件及时安装安全补丁。
补丁管理由 NIST CSF 2.0 成果 PR.PS-02 (Software is maintained, replaced, and removed commensurate with risk) 定义。 对照映射 通过 ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53 和 NIS2 中已发布的对照表完成映射。 编辑说明 在 SOC 2, Essential Eight, DORA 和 Cyber Essentials 中经编辑映射。 在 HIPAA 中仅弱相关。 本站数据中无映射 本站数据中 GDPR 和 CPS 234 无映射。
| 框架 | 要求 | 标题 | 链接 | 来源 / 原因 |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | 主题定义 | PR.PS-02 |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | 对照映射 | A.8.8: via NIST 800-53 map: SI-2 |
| CIS v8.1 | CIS 2.2CIS 7.3CIS 7.4CIS 12.1 | Ensure Authorized Software is Currently Supported; Perform Automated Operating System Patch Management; Perform Automated Application Patch Management… | 对照映射 | CIS 2.2: via PR.PS-02 CIS 7.3: Automated OS patch management; not in CIS's own crosswalk to CSF 2.0, which covers 49 of 153 safeguards. CIS 7.4: Automated application patch management; not in CIS's own crosswalk to CSF 2.0, which covers 49 of 153 safeguards. CIS 12.1: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): keep network infrastructure up to date. |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | 编辑说明 | CC7.1: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 6.3.16.3.3 | Vulnerabilities identified and risk-ranked; Security patches installed promptly | 对照映射 | 6.3.1: via PR.PS-02 6.3.3: via PR.PS-02 |
| CMMC | SI.L2-3.14.1 | Flaw Remediation | 对照映射 | SI.L2-3.14.1: via 800-171r3 03.14.01 ↔ PR.PS-02 → SI-2; 800-171r2 Appendix D → SI-2 |
| 800-53 | SI-2 | Flaw Remediation | 对照映射 | SI-2: via PR.PS-02 |
| HIPAA | §164.312(c)§164.312(c)(2)§164.312(e)(2)(i) | 未映射到此主题 | 这些要求仅通过已发布的交叉映射与本主题的 CSF 成果（PR.PS-02）存在关联：值得核查，但不构成映射。 | |
| GDPR | — | 无要求 | 本站数据中无映射 | 本站数据中没有 GDPR 要求映射到此主题。 |
| NIS2 | 6.6 | Security patch management | 对照映射 | 6.6: via PR.PS-02 |
| Essential Eight | ISM-1876ISM-1691ISM-1693ISM-1877ISM-1695ISM-1704ISM-1501 | Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of…; Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release; Patches, updates or other vendor mitigations for vulnerabilities in applications other…… | 编辑说明 | ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.9(4)(f) | Protection and prevention | 编辑说明 | Art.9(4)(f): Appropriate and comprehensive documented policies for patches and updates. |
| CPS 234 | — | 无要求 | 本站数据中无映射 | 本站数据中没有 CPS 234 要求映射到此主题。 |
| Cyber Essentials | CE 3 | Security Update Management | 编辑说明 | CE 3: All software licensed and supported, automatic updates where possible, and critical or high-risk updates applied within 14 days. |
主题定义 定义本主题的 CSF 2.0 结果 · 对照映射 至少一项选择有已发布对照表作为依据 · 编辑说明 ControlMapping 的判断及理由 · 未映射，仅与该主题的 CSF 成果相同 · 本站数据中无映射 我们的数据中未映射任何内容；通常为新工作，但请查看覆盖范围说明. 方法说明.
要求编号和标题均按各框架官方发布的英文原文显示。
映射有误或缺失？ 报告
关于补丁管理
补丁管理是指对操作系统、应用程序、固件和第三方软件的安全更新进行系统化的识别、测试和部署，以修复已知漏洞的过程。各框架的时限要求有所不同：PCI DSS 要求在补丁发布后一个月内安装关键和高危安全补丁（6.3.3），Essential Eight 按成熟度等级设定固定时限，而大多数其他框架则要求你定义基于风险的时限，并在投入生产环境前对补丁进行测试。自动化补丁管理工具结合准确的资产清单，有助于确保全面覆盖，并缩短系统暴露于已知漏洞利用的时间窗口。