[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F21-2-e":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","21-2-e","Article 21(2)(e)","Security in acquisition, development and maintenance (Article 21(2)(e))",0,"Directive (EU) 2022\u002F2555 (NIS2)","**What it asks for.** Point (e) requires security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure. Security has to be considered across the life of systems, not only at deployment.\n\n**In practice.** Security requirements are defined when buying or building systems, development follows a secure life cycle with testing, change and patch management keep systems maintained, and a vulnerability handling process covers discovery, prioritisation, remediation and coordinated disclosure. Evidence includes procurement requirements, secure development procedures, patch metrics and a vulnerability disclosure policy.\n\n**Common gaps.** Security requirements are often missing from procurement of off the shelf and SaaS products. Few entities publish a clear way for outsiders such as researchers to report vulnerabilities.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_21","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},146,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"internet-connected-refrigeration-units-expose-critical-infrastructure-to-root-level-attacks","Internet-Connected Refrigeration Units Expose Critical Infrastructure to Root-Level Attacks","2026-11-13T22:21:16.893+00:00",{"slug":24,"title":25,"published_at":26},"actively-exploited-vulnerabilities-added-to-cisa-kev-catalog-demand-immediate-remediation","Actively Exploited Vulnerabilities Added to CISA KEV Catalog Demand Immediate Remediation","2026-11-13T21:21:21.381+00:00",{"slug":28,"title":29,"published_at":30},"exposed-camera-software-exploited-to-mine-cryptocurrency-across-13-organizations","Exposed Camera Software Exploited to Mine Cryptocurrency Across 13 Organizations","2026-11-13T21:21:00.22+00:00",{"slug":32,"title":33,"published_at":34},"cve-volume-hits-100k-ai-driven-discovery-outpaces-human-patching-capacity","CVE Volume Hits 100K: AI-Driven Discovery Outpaces Human Patching Capacity","2026-11-13T21:20:43.015+00:00",{"slug":36,"title":37,"published_at":38},"unpatched-check-point-gateways-leveraged-to-wipe-vmware-esxi-infrastructure","Unpatched Check Point Gateways Leveraged to Wipe VMware ESXi Infrastructure","2026-11-13T17:20:43.507+00:00",{"slug":40,"title":41,"published_at":42},"1252-cves-in-one-month-why-blind-patching-is-as-dangerous-as-not-patching","1,252 CVEs in One Month: Why Blind Patching Is as Dangerous as Not Patching","2026-11-13T16:20:44.156+00:00",{"slug":44,"title":45,"published_at":46},"critical-citrix-netscaler-flaw-in-default-installations-demands-immediate-patching","Critical Citrix NetScaler Flaw in Default Installations Demands Immediate Patching","2026-11-13T15:21:00.274+00:00",{"slug":48,"title":49,"published_at":50},"malware-hidden-in-drone-software-update-grounds-german-military-fleet","Malware Hidden in Drone Software Update Grounds German Military Fleet","2026-11-13T14:20:41.076+00:00",{"slug":52,"title":53,"published_at":54},"unpatched-check-point-gateways-wiped-after-chained-exploit-attack","Unpatched Check Point Gateways Wiped After Chained Exploit Attack","2026-11-13T13:22:53.744+00:00",{"slug":56,"title":57,"published_at":58},"critical-apache-http-server-rce-flaw-demands-immediate-patching-action","Critical Apache HTTP Server RCE Flaw Demands Immediate Patching Action","2026-11-13T11:22:30.389+00:00",{"slug":60,"title":61,"published_at":62},"windows-zero-day-exploits-staged-rollout-gap-to-escalate-privileges-to-system","Windows Zero-Day Exploits Staged Rollout Gap to Escalate Privileges to SYSTEM","2026-11-13T11:21:52.625+00:00",{"slug":64,"title":65,"published_at":66},"check-point-zero-day-exploited-for-root-access-via-ipc-interface-flaw","Check Point Zero-Day Exploited for Root Access via IPC Interface Flaw","2026-11-13T11:20:59.093+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",122,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",99,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",42,{"slug":84,"name":85,"problem":86,"stories":87},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",20,{"slug":89,"name":90,"problem":91,"stories":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",17,{"slug":94,"name":95,"problem":96,"stories":97},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",15,[99,105,111,117,122,127,132,137],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","7","Control 7","Continuous Vulnerability Management",133,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-800-53","si-2","SI-2","Flaw Remediation",121,{"family":112,"item":113,"code":114,"title":115,"together":116},"nist-csf","rs-mi","RS.MI-3","Mitigation (CSF 1.1)",59,{"family":100,"item":118,"code":119,"title":120,"together":121},"2","Control 2","Inventory and Control of Software Assets",52,{"family":112,"item":123,"code":124,"title":125,"together":126},"id-ra","ID.RA-1","Risk Assessment",21,{"family":128,"item":129,"code":130,"title":131,"together":92},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",{"family":100,"item":133,"code":134,"title":135,"together":136},"12","Control 12","Network Infrastructure Management",16,{"family":100,"item":138,"code":139,"title":140,"together":141},"4","Control 4","Secure Configuration of Enterprise Assets and Software",11]