[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsi-2":3},{"item":4,"lessons":18,"controls":69,"related":100},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","si-2","SI-2","Flaw Remediation",1770,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must find, report and fix flaws in its systems, test security updates for effectiveness and side effects before installing them, install security-relevant updates within a defined time after release, and fold flaw remediation into configuration management.\n\n**In practice.** Good practice is a written patching standard with timelines tied to severity and exploitation status, an inventory that tells you what needs patching, and automated deployment with a short test ring before broad rollout. Auditors expect the standard, patch compliance reports over time, records of tested changes and documented exceptions with compensating controls. This is the same idea as continuous vulnerability management in CIS Control 7 and technical vulnerability management in ISO\u002FIEC 27001 Annex A.\n\n**Common gaps.** Typical gaps are patching operating systems well while third-party applications, firmware and network appliances lag, and exceptions that never expire. Many teams also cannot show how long remediation actually took against their own deadlines.","a. Identify, report, and correct system flaws;\n  b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;\n  c. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates; and\n  d. Incorporate flaw remediation into the organizational configuration management process.\nDiscussion: The need to remediate system flaws applies to all types of software and firmware. Organizations identify systems affected by software flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated organizational personnel with information security and privacy responsibilities. Organizations consider establishing a controlled patching environment for mission-critical systems. Security-relevant updates include patches, service packs, and malicious code signatures. Organizations also address flaws discovered during assessments, continuous monitoring, incident response activities, and system error handling. By incorporating flaw remediation into configuration management processes, required remediation actions can be tracked and verified.\n\nOrganization-defined time periods for updating security-relevant software and firmware may vary based on a variety of risk factors, including the security category of the system, the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw), the organizational risk tolerance, the mission supported by the system, or the threat environment. Some types of flaw remediation may require more testing than other types. Organizations determine the type of testing needed for the specific type of flaw remediation activity under consideration and the types of changes that are to be configuration-managed. Flaw remediation testing addresses both effectiveness of addressing security issues and for potential side effects on functionality, system and system component performance and operations. When implementing remediation activities, organizations consider the order and timing of updates to validate correct execution within the system environment, and to support system and component availability needs (i.e., implementing a staggered deployment strategy). In some situations, organizations may determine that the testing of software or firmware updates is not necessary or practical, such as when implementing simple malicious code signature updates. In testing decisions, organizations consider whether security-relevant software or firmware updates are obtained from authorized sources with appropriate digital signatures.\n\nWhen implementing remediation activities, organizations consider the order and timing of updates to validate correct execution within the system environment, and to support system and component availability needs (i.e., implementing a staggered deployment strategy). Organizations verify that software and firmware updates come from authorized sources prior to downloading.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},3403,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"internet-connected-refrigeration-units-expose-critical-infrastructure-to-root-level-attacks","Internet-Connected Refrigeration Units Expose Critical Infrastructure to Root-Level Attacks","2026-11-13T22:21:16.893+00:00",{"slug":26,"title":27,"published_at":28},"actively-exploited-vulnerabilities-added-to-cisa-kev-catalog-demand-immediate-remediation","Actively Exploited Vulnerabilities Added to CISA KEV Catalog Demand Immediate Remediation","2026-11-13T21:21:21.381+00:00",{"slug":30,"title":31,"published_at":32},"exposed-camera-software-exploited-to-mine-cryptocurrency-across-13-organizations","Exposed Camera Software Exploited to Mine Cryptocurrency Across 13 Organizations","2026-11-13T21:21:00.22+00:00",{"slug":34,"title":35,"published_at":36},"unpatched-check-point-gateways-leveraged-to-wipe-vmware-esxi-infrastructure","Unpatched Check Point Gateways Leveraged to Wipe VMware ESXi Infrastructure","2026-11-13T17:20:43.507+00:00",{"slug":38,"title":39,"published_at":40},"1252-cves-in-one-month-why-blind-patching-is-as-dangerous-as-not-patching","1,252 CVEs in One Month: Why Blind Patching Is as Dangerous as Not Patching","2026-11-13T16:20:44.156+00:00",{"slug":42,"title":43,"published_at":44},"critical-citrix-netscaler-flaw-in-default-installations-demands-immediate-patching","Critical Citrix NetScaler Flaw in Default Installations Demands Immediate Patching","2026-11-13T15:21:00.274+00:00",{"slug":46,"title":47,"published_at":48},"unpatched-check-point-gateways-wiped-after-chained-exploit-attack","Unpatched Check Point Gateways Wiped After Chained Exploit Attack","2026-11-13T13:22:53.744+00:00",{"slug":50,"title":51,"published_at":52},"critical-apache-http-server-rce-flaw-demands-immediate-patching-action","Critical Apache HTTP Server RCE Flaw Demands Immediate Patching Action","2026-11-13T11:22:30.389+00:00",{"slug":54,"title":55,"published_at":56},"windows-zero-day-exploits-staged-rollout-gap-to-escalate-privileges-to-system","Windows Zero-Day Exploits Staged Rollout Gap to Escalate Privileges to SYSTEM","2026-11-13T11:21:52.625+00:00",{"slug":58,"title":59,"published_at":60},"check-point-zero-day-exploited-for-root-access-via-ipc-interface-flaw","Check Point Zero-Day Exploited for Root Access via IPC Interface Flaw","2026-11-13T11:20:59.093+00:00",{"slug":62,"title":63,"published_at":64},"microsofts-november-patch-tuesday-breaks-windows-activation","Microsoft's November Patch Tuesday Breaks Windows Activation","2026-11-13T10:21:11.124+00:00",{"slug":66,"title":67,"published_at":68},"critical-citrix-netscaler-flaws-demand-immediate-patching-1794565253454","Critical Citrix NetScaler Flaws Demand Immediate Patching","2026-11-13T10:20:53.412+00:00",[70,75,80,85,90,95],{"slug":71,"name":72,"problem":73,"stories":74},"patch-management","Automated patch management","Known holes get closed in days, not months.",2124,{"slug":76,"name":77,"problem":78,"stories":79},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",1752,{"slug":81,"name":82,"problem":83,"stories":84},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",1080,{"slug":86,"name":87,"problem":88,"stories":89},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",482,{"slug":91,"name":92,"problem":93,"stories":94},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",370,{"slug":96,"name":97,"problem":98,"stories":99},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",339,[101,107,113,119,125,130,135,141],{"family":102,"item":103,"code":104,"title":105,"together":106},"cis","7","Control 7","Continuous Vulnerability Management",2705,{"family":108,"item":109,"code":110,"title":111,"together":112},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",1581,{"family":114,"item":115,"code":116,"title":117,"together":118},"nist-csf","pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",1401,{"family":120,"item":121,"code":122,"title":123,"together":124},"nis2","21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",1172,{"family":126,"item":127,"code":128,"title":128,"together":129},"itil","overview","ITIL",1041,{"family":102,"item":131,"code":132,"title":133,"together":134},"12","Control 12","Network Infrastructure Management",981,{"family":136,"item":137,"code":138,"title":139,"together":140},"gdpr","32","Article 32","Security of processing",959,{"family":142,"item":143,"code":144,"title":145,"together":146},"owasp","top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components",833]