3.7.1

5.2.2.1 The organization shall have up-to-date security patches for all software and hardware installed to protect assets from known vulnerabilities.

5.2.2.2 The organization shall enable automatic patching for all software and hardware or document all instances where they make the business decision not to do so.

5.2.2.3 The organization shall perform a risk assessment whether to replace systems incapable of automatic patching.

5.4.2.1 The organization shall implement secure configurations for all their devices by:
a) changing all default passwords.

5.4.3.1 The organization shall implement secure configurations for all their devices unless it is impossible to do so on a specific device:
a) by turning off unnecessary features i.e., block unused ports, disable unused services, remove unused or obsolete software; and
b) by enabling all relevant security features.