SekitCrosswalk
ENES
Start now
NIST CSF 2.0 · derived mapping target

PR.PS-02Software maintained

Keep software patched, updated, and retired in line with risk, so known vulnerabilities are closed promptly and unsupported software is removed.

Mapping at a glance
PR.PS-02Software maintainedNIST CSF 2.0
RCF-0139Container securityApplication Security · PolicyRCF-0140Container securityApplication Security · ProcessRCF-0141Container securityApplication Security · TechnicalRCF-0145Configuration baselinesEndpoint Security · PolicyRCF-0146Configuration baselinesEndpoint Security · Process

PR.PS-02 is covered by 48 Sekit CSF controls. +43 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0139Container security · PolicyRCF-0140Container security · ProcessRCF-0141Container security · TechnicalRCF-0145Configuration baselines · PolicyRCF-0146Configuration baselines · ProcessRCF-0147Configuration baselines · TechnicalRCF-0148EDR/anti-malware · PolicyRCF-0149EDR/anti-malware · ProcessRCF-0150EDR/anti-malware · TechnicalRCF-0151MDM/MAM · PolicyRCF-0152MDM/MAM · ProcessRCF-0153MDM/MAM · TechnicalRCF-0154Patch management · PolicyRCF-0155Patch management · ProcessRCF-0156Patch management · TechnicalRCF-0157Removable media control · PolicyRCF-0158Removable media control · ProcessRCF-0159Removable media control · TechnicalRCF-0160Device hardening · PolicyRCF-0161Device hardening · ProcessRCF-0162Device hardening · TechnicalRCF-0175Secure DNS · PolicyRCF-0176Secure DNS · ProcessRCF-0177Secure DNS · TechnicalRCF-0193Time sync · PolicyRCF-0194Time sync · ProcessRCF-0195Time sync · TechnicalRCF-0223Configuration management · PolicyRCF-0224Configuration management · ProcessRCF-0225Configuration management · TechnicalRCF-0226Baseline compliance · PolicyRCF-0227Baseline compliance · ProcessRCF-0228Baseline compliance · TechnicalRCF-0229Patch prioritization · PolicyRCF-0230Patch prioritization · ProcessRCF-0231Patch prioritization · TechnicalRCF-0337CSPM posture · PolicyRCF-0338CSPM posture · ProcessRCF-0339CSPM posture · TechnicalRCF-0346Workload protection · PolicyRCF-0347Workload protection · ProcessRCF-0348Workload protection · TechnicalRCF-0352SaaS security configuration · PolicyRCF-0353SaaS security configuration · ProcessRCF-0354SaaS security configuration · TechnicalRCF-0424Patch/compensating controls (ICS) · PolicyRCF-0425Patch/compensating controls (ICS) · ProcessRCF-0426Patch/compensating controls (ICS) · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.8.9 Configuration managementA.8.16 Monitoring activitiesA.5.1 Policies for information securityA.8.8 Management of technical vulnerabilitiesA.8.7 Protection against malwareA.8.1 User endpoint devicesA.8.20 Networks securityA.5.23 Information security for use of cloud servicesA.7.10 Storage mediaA.8.17 Clock synchronizationA.5.36 Compliance with policies, rules and standards for information securityA.8.25 Secure development life cycleA.5.37 Documented operating proceduresA.5.22 Monitoring, review and change management of supplier servicesA.8.29 Security testing in development and acceptanceA.6.7 Remote workingA.5.7 Threat intelligenceA.8.12 Data leakage preventionA.8.23 Web filtering

Cyber Essentials counterparts

CE2.1 Remove unnecessary accounts and softwareCE2.2 Change default and guessable passwordsCE3.2 Apply critical updates within 14 daysCE5.1 Operate a malware protection mechanismCE5.2 Restrict execution to approved softwareCE3.1 Use licensed and supported softwareCE4.3 Require multi-factor authenticationCE2.3 Enforce device unlocking credentials

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Software and SaaS inventory
The list of installed software and cloud apps the company uses, with their licences, and a sense of which tools people use that are not officially approved.
Patch management report
The proof that security updates are applied on time across devices and systems, with tracking of what is still outstanding.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

DE.CM-01 Networks monitoredDE.CM-03 Personnel activity monitoredID.RA-01 Vulnerabilities identified and recordedID.RA-05 Inherent risk understoodID.RA-07 Changes and exceptions managedPR.DS-01 Data-at-rest protectedPR.IR-01 Networks protected from unauthorized accessPR.PS-01 Configuration management applied
Ask Sekura: “What evidence proves PR.PS-02?”
Also via MCP, free with account