NIST Cybersecurity Framework 2.0 NIST-CSF-ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

What else in your programme already covers this

This control maps to 135 controls across 51 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 11 controls

11.3.1 11.3.1 Quarterly internal vulnerability scans
11.3.1.1 11.3.1.1 Lower-risk vulnerabilities handled per risk analysis
11.3.1.2 11.3.1.2 Authenticated internal vulnerability scanning
11.3.1.3 11.3.1.3 Internal scans after significant change
11.3.2 11.3.2 Quarterly ASV external vulnerability scans
11.3.2.1 11.3.2.1 External scans after significant change
12.6.1 12.6.1 Formal security awareness program
5.3.2.1 5.3.2.1 Targeted risk analysis sets malware scan frequency
6.4.1 6.4.1 Public web application review or automated protection
6.3.1 6.3.1 Vulnerability identification and risk ranking
6.3.3 6.3.3 Timely installation of security patches

CIS Controls v8 · 9 controls

CIS-16.2 Establish and Maintain a Process to Accept and Address Software Vulnerabilities
CIS-16.5 Use Up-to-Date and Trusted Third-Party Software Components
CIS-16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities
CIS-18.1 Establish and Maintain a Penetration Testing Program
CIS-2.2 Ensure Authorized Software is Currently Supported
CIS-7.1 Establish and Maintain a Vulnerability Management Process
CIS-7.4 Perform Automated Application Patch Management
CIS-7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets
CIS-7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets

NIST SP 800-218 · 7 controls

SP800-218-PW.7.1 Code Review
SP800-218-PW.7.2 Perform Code Review and Analysis
SP800-218-PW.8.1 Executable Testing for Security
SP800-218-PW.8.2 Execute Security Testing
SP800-218-RV.1.1 Identify and Confirm Vulnerabilities on an Ongoing Basis
SP800-218-RV.1.2 Review and Analyze Code for Vulnerabilities
SP800-218-RV.3.2 Identify and Fix Similar Vulnerabilities

BIMCO Cyber Security · 6 controls

BIMCO-3.1 Common vulnerabilities
BIMCO-3.3 Typical vulnerable systems
BIMCO-3.4 Ship to shore interface
BIMCO-4 Chapter 4: Assessing the likelihood
BIMCO-5.1 The CIA model
BIMCO-6.2 The four phases of a risk assessment

FedRAMP High · 6 controls

CA-5 Plan of Action and Milestones
RA-5 Vulnerability Monitoring and Scanning
RA-5(2) Update Vulnerabilities to be Scanned
RA-5(3) Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage (RA-5(3))
SI-2 Flaw Remediation
SI-2(2) Automated Flaw Remediation Status

FedRAMP Moderate · 6 controls

CA-5 Plan of Action and Milestones
RA-5 Vulnerability Monitoring and Scanning
RA-5(2) Update Vulnerabilities to be Scanned
RA-5(3) Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage (RA-5(3))
SI-2 Flaw Remediation
SI-2(2) Automated Flaw Remediation Status

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 5 controls

CFTC-SS-13 Vulnerability Testing
CFTC-SS-14 External Penetration Testing
CFTC-SS-17 Enterprise Technology Risk Assessment
CFTC-SS-21 Remediation of Vulnerabilities and Deficiencies
CFTC-SS-34 Internal Penetration Testing

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

CCM-AIS-05 Automated Application Security Testing
CCM-AIS-07 Application Vulnerability Remediation
CCM-TVM-05 External Library Vulnerabilities
CCM-TVM-07 Vulnerability Identification
CCM-TVM-09 Vulnerability Management Reporting

C5 (Germany) · 4 controls

C5-OPS-18 Managing Vulnerabilities, Malfunctions and Errors - Concept
C5-OPS-22 Testing and Documentation of known Vulnerabilities
C5-PSS-02 Identification of Vulnerabilities of the Cloud Service
C5-PSS-03 Online Register of Known Vulnerabilities

NIST SP 800-53 Rev 5 · 4 controls

NIST800-RA-5 RA-5 Vulnerability Monitoring and Scanning
NIST800-SI-2 SI-2 Flaw Remediation
SP800-53-RA Risk Assessment Family
SP800-53-SI System and Information Integrity Family

SOC 2 · 4 controls

SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)
SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
SOC2-CC9.1 CC9.1 Mitigating risks of business disruption

Australian Information Security Manual · 3 controls

ISM-1163 Continuous monitoring plan
ISM-1701 Daily scanning of internet-facing OS
ISM-1808 Up-to-date vulnerability database for scanning

Azure Security Benchmark · 3 controls

ASBv3-DS-4 Integrate static application security testing into DevOps pipeline
DS-2 Ensure software supply chain security
PV-5 Perform vulnerability assessments

CMMC 2.0 · 3 controls

RA.L2-3.11.2 Vulnerability Scan
RA.L2-3.11.3 Vulnerability Remediation
SI.L2-3.14.1 Flaw Remediation

Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 · 3 controls

CIRMP-s6 Identification of material risks
CIRMP-s7 General requirement - minimise, eliminate and mitigate all hazards
CIRMP-s8 Cyber and information security hazard management

DORA · 3 controls

DORA-Art.13 Learning and evolving
DORA-Art.25 Testing of ICT tools and systems
DORA-Art.8 Identification

NIST Cybersecurity Framework 1.0 · 3 controls

DE.CM-8 DE.CM-8: Vulnerability scans are performed
ID.RA-1 ID.RA-1: Asset vulnerabilities are identified and documented
PR.IP-12 PR.IP-12: A vulnerability management plan is developed and implemented

NIST Cybersecurity Framework 1.1 · 3 controls

DE.CM-8 DE.CM-8: Vulnerability scans are performed
ID.RA-1 ID.RA-1: Asset vulnerabilities are identified and documented
PR.IP-12 PR.IP-12: A vulnerability management plan is developed and implemented

ACSC Essential Eight · 2 controls

E8-PATCHAPP-ML1 Patch Applications (ML1)
E8-PATCHOS-ML1 Patch Operating Systems (ML1)

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

ANSSI-HYG-34 Define an Update Policy for Information System Components
ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

ASD37-02 Patch applications (Essential)
ASD37-19 Patch operating systems (Essential)

AWS Well-Architected Security Pillar · 2 controls

SEC06-BP01 Perform vulnerability management
SEC11-BP02 Automate testing throughout the development and release lifecycle

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

AWWA-1.2 Risk Assessment
AWWA-4.2 Patch Management

Australian Energy Sector Cyber Security Framework (AESCSF) · 2 controls

AESCSF-RM-2 Identify and assess cyber risks
AESCSF-TVM-1 Vulnerability management

Belgium CyberFundamentals · 2 controls

BE-CF-13 Risk assessment procedures
BE-CF-14 Vulnerability scanning and management

Bermuda Monetary Authority (BMA) Cyber Risk Management Code of Conduct · 2 controls

BMA-21 Security Testing Programme
BMA-6 Risk Assessment Process

C2M2 · 2 controls

RISK-2 Identify and Analyze Cyber Risk
THREAT-2 Reduce Cybersecurity Vulnerabilities

China Cybersecurity Law (CSL) · 2 controls

CSL-Art22 Security of Network Products and Services - Art. 22
CSL-Art38 CII Annual Security Inspection - Art. 38

China Data Security Law (DSL) · 2 controls

DSL-Art22 National Data Security Risk Assessment, Monitoring and Early Warning (Art. 22)
DSL-Art30 Important Data Risk Assessment and Reporting (Art. 30)

EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04) · 2 controls

EBA-GL-3.3.2 Identification of functions, processes and assets
EBA-GL-3.3.3 Classification and risk assessment

NIST SP 800-171 Rev 3 · 2 controls

03.11.02 Vulnerability Monitoring and Scanning
03.14.01 Flaw Remediation

NIST SP 800-172 · 2 controls

3.12.1e Penetration Testing by Independent Agents
3.14.7e Verify Correctness of Security Functions

ASIC Cyber Resilience Good Practices · 1 control

ASIC-CR-DE-3 Red teaming

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-4 Formal vulnerability management program

Australia My Health Records Act 2012 · 1 control

MYHR-SEC-5 Security risk assessment

C-TPAT - Customs-Trade Partnership Against Terrorism · 1 control

CTPAT-MSC-2 Risk Assessment

CCSDS 350.0-G-3 - Space Communications Security (Consultative Committee for Space Data Systems) · 1 control

CCSDS350-2.3 Types of Threat

Canada ITSG-33 - IT Security Risk Management · 1 control

ITSG33-RA Risk Assessment (RA)

China Personal Information Protection Law (PIPL) · 1 control

PIPL-Art55 Personal Information Protection Impact Assessment

ENISA Data Protection Engineering - From Theory to Practice · 1 control

ENISA-DPE-2.2 Connection with the Data Protection Impact Assessment

FAA Aircraft Systems Information Security Protection (ASISP) · 1 control

FAA-CSA-Governance FAA Cybersecurity Strategy, Governance and Order 1370.123A

HIPAA Security Rule · 1 control

164.308(a)(1)(ii)(A) Risk Analysis (Required)

ISO 27001:2022 · 1 control

8.8 Management of technical vulnerabilities

ISO 27002:2022 · 1 control

8.8 Management of technical vulnerabilities

ISO 27701:2019 · 1 control

6.9.6 Technical vulnerability management

NIS2 Directive · 1 control

Art.21.2.e Security in acquisition, development and maintenance, including vulnerability handling and disclosure

NIST SP 800-161 Rev 1 · 1 control

161R1-RA-5 Vulnerability Monitoring and Scanning

NIST SP 800-61 Rev. 3 · 1 control

ID.RA-01 ID.RA-01 All types of known vulnerabilities understood for risk decisions

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(1)(ii)(A) Risk Analysis (Required)

UK Cyber Essentials · 1 control

CE-SU.3 Critical and High Updates within 14 Days

US Executive Order 14144 - Strengthening and Promoting Innovation in the Nation's Cybersecurity · 1 control

6(e) Sec. 6(e) (now 5(b)) Manage AI software vulnerabilities and compromises in vulnerability management

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.