[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsa-12":3},{"item":4,"lessons":17,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":15,"updated_at":16},"nist-800-53","sa-12","SA-12","Supply Chain Protection",304,"US National Institute of Standards and Technology (NIST)","**What it asks for.** SA-12 Supply Chain Protection existed in Revision 4 of SP 800-53. In Revision 5 it was withdrawn and its content moved into the new Supply Chain Risk Management (SR) family. The underlying aim remains protecting against supply chain threats to systems, components and services.\n\n**In practice.** Organisations working to Revision 5 should look at controls such as SR-3 (supply chain controls and processes), SR-6 (supplier assessments and reviews) and SR-11 (component authenticity). Typical activities include a supplier risk process, security requirements in contracts, assessment of critical suppliers and checks on the origin and integrity of software and hardware. Auditors would expect to see the current SR controls mapped, rather than SA-12, in a Revision 5 assessment.\n\n**Common gaps.** A common gap is carrying old Revision 4 mappings forward without updating them to the SR family. Supplier risk activity is also often limited to onboarding questionnaires with no ongoing review.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST","This control was withdrawn in SP 800-53 Rev. 5; its content moved to other controls.","2026-10-18T15:18:43.663+00:00",{"total":18,"list":19},320,[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"fake-interview-assignments-weaponize-npm-packages-to-compromise-developer-machines","Fake Interview Assignments Weaponize npm Packages to Compromise Developer Machines","2026-11-13T18:21:36.396+00:00",{"slug":25,"title":26,"published_at":27},"leaked-secrets-and-a-backdoored-ai-tool-give-attackers-cloud-access-in-minutes","Leaked Secrets and a Backdoored AI Tool Give Attackers Cloud Access in Minutes","2026-11-13T16:21:03.622+00:00",{"slug":29,"title":30,"published_at":31},"malware-hidden-in-drone-software-update-grounds-german-military-fleet","Malware Hidden in Drone Software Update Grounds German Military Fleet","2026-11-13T14:20:41.076+00:00",{"slug":33,"title":34,"published_at":35},"mcp-server-pinning-drift-exposes-ai-coding-assistants-to-malicious-dependencies","MCP Server 'Pinning Drift' Exposes AI Coding Assistants to Malicious Dependencies","2026-11-13T06:20:23.867+00:00",{"slug":37,"title":38,"published_at":39},"ai-coding-agents-hijacked-via-poisoned-training-data-and-model-checkpoints","AI Coding Agents Hijacked via Poisoned Training Data and Model Checkpoints","2026-11-12T18:20:37.986+00:00",{"slug":41,"title":42,"published_at":43},"client-side-supply-chain-attacks-bypass-all-traditional-security-controls","Client-Side Supply Chain Attacks Bypass All Traditional Security Controls","2026-11-12T15:22:17.578+00:00",{"slug":45,"title":46,"published_at":47},"client-side-supply-chain-attacks-can-bypass-all-security-controls-at-runtime","Client-Side Supply Chain Attacks Can Bypass All Security Controls at Runtime","2026-11-12T15:21:39.056+00:00",{"slug":49,"title":50,"published_at":51},"60000-github-repos-poisoned-via-hijacked-accounts-and-workflow-injection","60,000 GitHub Repos Poisoned via Hijacked Accounts and Workflow Injection","2026-11-12T14:21:55.79+00:00",{"slug":53,"title":54,"published_at":55},"net-11-hardens-nuget-and-container-pipelines-against-supply-chain-attacks",".NET 11 Hardens NuGet and Container Pipelines Against Supply Chain Attacks","2026-11-12T09:20:38.657+00:00",{"slug":57,"title":58,"published_at":59},"stolen-github-credentials-enable-mass-ci-secret-theft-across-tens-of-thousands-of-repositories","Stolen GitHub Credentials Enable Mass CI Secret Theft Across Tens of Thousands of Repositories","2026-11-12T03:20:21.953+00:00",{"slug":61,"title":62,"published_at":63},"browser-extensions-are-a-silent-supply-chain-threat","Browser Extensions Are a Silent Supply-Chain Threat","2026-11-11T20:20:24.025+00:00",{"slug":65,"title":66,"published_at":67},"ai-coding-assistant-mcp-servers-expose-api-keys-via-poisoned-dependencies","AI Coding Assistant MCP Servers Expose API Keys via Poisoned Dependencies","2026-11-11T17:20:58.508+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",160,{"slug":75,"name":76,"problem":77,"stories":78},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",158,{"slug":80,"name":81,"problem":82,"stories":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",86,{"slug":85,"name":86,"problem":87,"stories":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",68,{"slug":90,"name":91,"problem":92,"stories":93},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",67,{"slug":95,"name":96,"problem":97,"stories":98},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",55,[100,106,112,118,123,128,134,139],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","2","Control 2","Inventory and Control of Software Assets",262,{"family":107,"item":108,"code":109,"title":110,"together":111},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",199,{"family":113,"item":114,"code":115,"title":116,"together":117},"gdpr","32","Article 32","Security of processing",146,{"family":101,"item":119,"code":120,"title":121,"together":122},"16","Control 16","Application Software Security",145,{"family":101,"item":124,"code":125,"title":126,"together":127},"7","Control 7","Continuous Vulnerability Management",117,{"family":129,"item":130,"code":131,"title":132,"together":133},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",111,{"family":5,"item":135,"code":136,"title":137,"together":138},"si-3","SI-3","Malicious Code Protection",97,{"family":140,"item":130,"code":141,"title":141,"together":142},"itil","ITIL",85]