NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning
Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning 3.5.4c: Unpatchable assets: periodically re-evaluate the alternatives to patching

What does 3.5.4c require?

Organisations should plan periodic re-evaluation of their alternatives to patching in two respects: a risk assessment of whether the alternatives still mitigate risk well enough, and a cost-benefit analysis of whether the asset's value justifies the extra cost of mitigating, transferring or accepting its risk.

Maintained by Gerard Blokdyk

Other controls in Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning controls