NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning
Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning 3.4: Assign every asset to a maintenance group

What does 3.4 require?

Organisations should combine their inventories, asset characteristics and risk response scenarios to place each asset in a maintenance group: assets that share characteristics and have broadly the same maintenance needs for each scenario, covering patch schedule, testing needs, outage restrictions, impact if compromised and alternative mitigations. Groups are defined at whatever granularity suits and reassessed periodically. Assets that cannot or should not be patched get their own groups rather than being treated as exceptions, because they still need maintenance.

Maintained by Gerard Blokdyk

Other controls in Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning controls