NIST SP 800-53 Rev 5 MODERATE CM-2(2): Automation Support for Accuracy and Currency

What else in your programme already covers this

This control maps to 19 controls across 12 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 4 controls

NIST800-CA-7 Continuous monitoring
NIST800-CM-2 Baseline configuration
NIST800-CM-3 Configuration change control
NIST800-CM-7 Least functionality

PCI DSS 4.0 · 3 controls

5.3.1 The anti-malware solution(s) is kept current via automatic updates
6.3.3 All system components are protected from known vulnerabilities by installing applicable security patches/updates as follows: • Patches/updates for critical vulnerabilities (identified according to the risk ranking process at Requirement 6.3.1) are installed within one
6.5.1 Changes to all system components in the production environment are made according to established procedures that include: • Reason for, and description of, the change. • Documentation of security impact. • Documented change approval

Azure Security Benchmark · 2 controls

ASBv3-PV-4 Audit and enforce secure configurations for compute resources
PV-2 Audit and enforce secure configurations

ISO 27002:2022 · 2 controls

8.32 Change management
8.9 Configuration management

AWS Well-Architected Security Pillar · 1 control

SEC01-BP06 Automate deployment of standard security controls

CIS Controls v8 · 1 control

CIS-4.6 Securely Manage Enterprise Assets and Software

CMMC 2.0 · 1 control

CM.L2-3.4.1 System Baselining

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-CCC-03 Change Management Technology

ISO 27001:2022 · 1 control

8.32 Change management

NIST SP 800-171 Rev 3 · 1 control

03.04.01 Baseline Configuration

NIST SP 800-172 · 1 control

3.4.3e Automated Inventory of System Components

SOC 2 · 1 control

SOC2-CC8.1 Change management processes are in place

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.