NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning
Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning 3.5: Define a maintenance plan for each group and scenario, with a process for choosing between plans

What does 3.5 require?

Organisations should write, for every maintenance group and every scenario that applies to it, a maintenance plan, setting the actions to take, the timeframes for starting and finishing each action and other relevant details, and should set up a risk assessment routine that decides which plan applies at a given time and when to switch plans as understanding of the risk changes. CISA's Known Exploited Vulnerabilities catalogue (mandatory for federal agencies under BOD 22-01, voluntary for others) and CISA's vulnerability response playbook are offered as prioritisation inputs.

Maintained by Gerard Blokdyk

Other controls in Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning controls