NIST 800-40 is primarily associated with?

• A. Patching
• B. Access Control
• C. Logging
• D. Email Security

Answer: (A)

NIST SP 800-40 provides guidelines for patch management, outlining how organizations identify, obtain, test, deploy, and verify patches to reduce vulnerability exposure. It describes a lifecycle you follow to keep systems up to date: maintain an inventory of assets, monitor for new patches and advisories, assess risk to prioritize which patches to apply, test patches in a controlled environment, implement them through a defined change process, verify successful installation, and track patch status and effectiveness. The core aim is to minimize security gaps by timely remediation of software and firmware vulnerabilities.

Because of that focus, patching is the best fit for what this publication covers. Logging, access control, and email security are important security topics as well, but they are addressed by other standards and guides rather than the patch-management-focused guidance in NIST 800-40.