NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning
Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning 3.2.1: Keep software inventories for all computing assets constantly up to date through automation

What does 3.2.1 require?

Organisations should establish and keep current software inventories across every computing asset, physical or virtual, OT, IoT and containers included, whether in one enterprise inventory or several linked sources. Because assets and software change constantly, a near-complete inventory depends on automation that keeps discovering new assets and refreshing their details; vendor-supplied software composition data such as an SBOM can add to it. Monthly or quarterly inventory refreshes by vulnerability scan belong to a static past and should no longer be relied on.

Maintained by Gerard Blokdyk

Other controls in Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning controls