Frameworks / NIST Cybersecurity Framework 2.0 / NIST-CSF-PR.PS-02 NIST Cybersecurity Framework 2.0
PR - Protect
NIST Cybersecurity Framework 2.0 NIST-CSF-PR.PS-02: Software is maintained, replaced, and removed commensurate with risk Software is maintained, replaced, and removed commensurate with risk. Control from NIST Cybersecurity Framework 2.0 framework, domain: PR - Protect.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 94 controls across 31 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CIS-12.1 Ensure Network Infrastructure is Up-to-Date CIS-13.5 Manage Access Control for Remote Assets CIS-15.7 Securely Decommission Service Providers CIS-16.2 Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS-16.5 Use Up-to-Date and Trusted Third-Party Software Components CIS-2.2 Ensure Authorized Software is Currently Supported CIS-2.3 Address Unauthorized Software CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS-7.1 Establish and Maintain a Vulnerability Management Process CIS-7.2 Establish and Maintain a Remediation Process CIS-7.3 Perform Automated Operating System Patch Management CIS-7.4 Perform Automated Application Patch Management CIS-7.7 Remediate Detected Vulnerabilities CIS-9.1 Ensure Use of Only Fully Supported Browsers and Email Clients ASD37-02 Patch applications (Essential) ASD37-10 Server application hardening (Very Good) ASD37-11 Operating system hardening (Very Good) ASD37-16 Antivirus software with signatures (Limited) ASD37-19 Patch operating systems (Essential) 7.14 Secure disposal or re-use of equipment 8.19 Installation of software on operational systems 8.32 Change management 8.8 Management of technical vulnerabilities 8.9 Configuration management 6.11 Systems acquisition, development and maintenance 6.11.2 Security in development and support processes 6.4.3 Termination and change of employment 6.9.5 Control of operational software 6.9.6 Technical vulnerability management 12.3.4 12.3.4 Annual review of hardware and software technologies 12.6.1 12.6.1 Formal security awareness program 5.2.1 5.2.1 Anti-malware deployed on all system components 6.3.2 6.3.2 Inventory of bespoke software and components 6.3.3 6.3.3 Timely installation of security patches ISM-0304 Removing unsupported applications ISM-1143 Patch management processes and procedures ISM-1501 Replacing unsupported operating systems ISM-1695 OS patches for workstations and internal systems within one month CE-SU.1 Software Licensed and Supported CE-SU.2 Automatic Updates Enabled Where Possible CE-SU.3 Critical and High Updates within 14 Days CE-SU.4 Remove Out-of-Support Software ANSSI-HYG-14 Apply a Minimum Security Level Across the Whole Estate ANSSI-HYG-34 Define an Update Policy for Information System Components ANSSI-HYG-35 Anticipate the End of Maintenance of Software and Systems AM-3 Ensure security of asset lifecycle management ASBv3-ES-3 Ensure anti-malware software and signatures are updated ASBv3-PV-6 Rapidly and automatically remediate vulnerabilities CM-8(1) Updates During Installation and Removal SA-22 Unsupported System Components (SA-22) SI-2 Flaw Remediation CM-8(1) Updates During Installation and Removal SA-22 Unsupported System Components (SA-22) SI-2 Flaw Remediation 8.19 Installation of software on operational systems 8.8 Management of technical vulnerabilities 8.9 Configuration management E8-PATCHAPP-ML1 Patch Applications (ML1) E8-PATCHAPP-ML3 Patch Applications (ML3) PR.IP-12 PR.IP-12: A vulnerability management plan is developed and implemented PR.MA-2 PR.MA-2: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access PR.IP-12 PR.IP-12: A vulnerability management plan is developed and implemented PR.MA-2 PR.MA-2: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access CPS230-P25 Information and Technology Capability and Asset Health AUCDR-IS-4 Formal vulnerability management program C5-OPS-18 Managing Vulnerabilities, Malfunctions and Errors - Concept Art.21.2.e Security in acquisition, development and maintenance, including vulnerability handling and disclosure 3.4.1e Authoritative Source for Software and Firmware SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in PR - Protect NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions NIST-CSF-PR.AA-03 Users, services, and hardware are authenticated NIST-CSF-PR.AA-04 Identity assertions are protected, conveyed, and verified NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties NIST-CSF-PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind NIST-CSF-PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done? NIST Cybersecurity Framework 2.0 NIST-CSF-PR.PS-02 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 94 it maps to, and the evidence behind each claim, over MCP and REST.