NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning
Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning 3.2.3: Treat patching per asset: record each asset's technical and mission characteristics

What does 3.2.3 require?

Organisations should plan patching asset by asset, recording for each computing asset both technical characteristics (platform type, who administers it, the management tooling, network connectivity, existing security controls, the privileges of its main users or connected services) and mission or business characteristics (role and importance, legal or policy deadlines for fixing vulnerabilities, contractual limits on patching, and operational restrictions such as reboot windows). Risk response decisions and priorities should rest on this context, not on software versions alone; a per-asset patch history also helps incident responders.

Maintained by Gerard Blokdyk

Other controls in Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning controls