NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning
Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning 3.6b: Make enterprise metrics reflect the relative importance of each asset and vulnerability

What does 3.6b require?

Organisations should use their low-level metrics to produce enterprise-level metrics that weight each vulnerability and patch by importance, because simple counts such as the share of vulnerabilities patched are not actionable. The guide's example is a matrix by asset importance (low, moderate, high) and vulnerability importance (low, medium, high, critical) showing the share of assets patched by the maintenance plan deadline and the mean and median time to patch, which can then be cut by platform, business unit or maintenance group to find where improvement and targets are needed.

Maintained by Gerard Blokdyk

Other controls in Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning controls