SekitCrosswalk
ENES
Start now
Cyber Essentials · derived mapping target

CE3.2Apply critical updates within 14 days

Turn on automatic updates where you can, and apply fixes for critical or high-risk vulnerabilities (CVSS v3 base score of 7 or above, or labelled critical/high by the vendor) within 14 days of release.

Mapping at a glance
CE3.2Apply critical updates within 14 daysCyber Essentials
RCF-0012Risk treatmentGovernance & Risk · TechnicalRCF-0127Dependency/SBOM managementApplication Security · PolicyRCF-0128Dependency/SBOM managementApplication Security · ProcessRCF-0129Dependency/SBOM managementApplication Security · TechnicalRCF-0140Container securityApplication Security · Process

CE3.2 is covered by 20 Sekit CSF controls. +15 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0012Risk treatment · TechnicalRCF-0127Dependency/SBOM management · PolicyRCF-0128Dependency/SBOM management · ProcessRCF-0129Dependency/SBOM management · TechnicalRCF-0140Container security · ProcessRCF-0141Container security · TechnicalRCF-0154Patch management · PolicyRCF-0155Patch management · ProcessRCF-0156Patch management · TechnicalRCF-0220Vulnerability remediation SLAs · PolicyRCF-0221Vulnerability remediation SLAs · ProcessRCF-0229Patch prioritization · PolicyRCF-0230Patch prioritization · ProcessRCF-0329Software supply chain (SBOM) · ProcessRCF-0330Software supply chain (SBOM) · TechnicalRCF-0403Release management · PolicyRCF-0404Release management · ProcessRCF-0405Release management · TechnicalRCF-0424Patch/compensating controls (ICS) · PolicyRCF-0425Patch/compensating controls (ICS) · Process

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.8.8 Management of technical vulnerabilitiesA.5.1 Policies for information securityA.8.9 Configuration managementA.5.37 Documented operating proceduresA.8.29 Security testing in development and acceptanceA.8.32 Change managementA.5.9 Inventory of information and other associated assetsA.8.25 Secure development life cycleA.5.21 Managing information security in the ICT supply chainA.5.36 Compliance with policies, rules and standards for information securityA.8.7 Protection against malwareA.8.31 Separation of development, test and production environmentsA.8.19 Installation of software on operational systems

NIST CSF 2.0 counterparts

PR.PS-02 Software maintainedPR.PS-01 Configuration management appliedID.RA-05 Inherent risk understoodPR.PS-04 Logs generated for monitoringGV.SC-06 Due diligence before engagementID.AM-08 Assets managed through lifecycleID.RA-07 Changes and exceptions managedID.RA-01 Vulnerabilities identified and recordedPR.PS-03 Hardware maintainedID.IM-02 Improvements from tests and exercisesGV.RM-05 Lines of communication for risk establishedGV.RM-06 Standardized risk method establishedGV.RM-07 Strategic opportunities characterizedGV.RM-04 Risk response strategy established

ISO/IEC 42001:2023 — Annex A counterparts

A.6.2.5 AI system deployment

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Patch management report
The proof that security updates are applied on time across devices and systems, with tracking of what is still outstanding.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

CE2.1 Remove unnecessary accounts and softwareCE3.1 Use licensed and supported softwareCE5.1 Operate a malware protection mechanismCE5.2 Restrict execution to approved software
Ask Sekura: “What evidence proves CE3.2?”
Also via MCP, free with account