Frameworks / Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 / CCM-TVM-03 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1
TVM - Threat & Vulnerability Management
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-TVM-03: Vulnerability Remediation Schedule Have defined routes for both scheduled and emergency response to a discovered vulnerability, chosen according to the risk that vulnerability carries.
Maintained by Gerard Blokdyk · Control text last updated 19 August 2026 What else in your programme already covers this This control maps to 53 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CIS-12.1 Ensure Network Infrastructure is Up-to-Date CIS-16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities CIS-18.3 Remediate Penetration Test Findings CIS-7.2 Establish and Maintain a Remediation Process CIS-7.3 Perform Automated Operating System Patch Management CIS-7.4 Perform Automated Application Patch Management CIS-7.7 Remediate Detected Vulnerabilities 11.3.1 11.3.1 Quarterly internal vulnerability scans 11.3.1.1 11.3.1.1 Lower-risk vulnerabilities handled per risk analysis 11.4.4 11.4.4 Correct exploitable findings from penetration tests 12.6.1 12.6.1 Formal security awareness program 6.3.3 6.3.3 Timely installation of security patches E8-PATCHAPP-ML1 Patch Applications (ML1) E8-PATCHAPP-ML3 Patch Applications (ML3) E8-PATCHOS-ML3 Patch Operating Systems (ML3) RA-5 Vulnerability Monitoring and Scanning SI-2 Flaw Remediation SI-2(3) Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions (SI-2(3)) RA-5 Vulnerability Monitoring and Scanning SI-2 Flaw Remediation SI-2(3) Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions (SI-2(3)) CE-SU.2 Automatic Updates Enabled Where Possible CE-SU.3 Critical and High Updates within 14 Days CE-SU.5 Firmware Updates ASD37-02 Patch applications (Essential) ASD37-19 Patch operating systems (Essential) SEC04-BP04 Initiate remediation for non-compliant resources SEC06-BP01 Perform vulnerability management NIST-CSF-ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated NIST-CSF-PR.PS-02 Software is maintained, replaced, and removed commensurate with risk ANSSI-HYG-34 Define an Update Policy for Information System Components AUCDR-IS-4 Formal vulnerability management program ASBv3-PV-6 Rapidly and automatically remediate vulnerabilities C5-OPS-22 Testing and Documentation of known Vulnerabilities CFTC-SS-21 Remediation of Vulnerabilities and Deficiencies TVM-08 Vulnerability Remediation Schedule 8.8 Management of technical vulnerabilities 8.8 Management of technical vulnerabilities 6.9.6 Technical vulnerability management Art.21.2.g Basic cyber hygiene practices and cybersecurity training Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in TVM - Threat & Vulnerability Management You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done? Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-TVM-03 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 53 it maps to, and the evidence behind each claim, over MCP and REST.