[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsi-5":3},{"item":4,"lessons":18,"controls":69,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","si-5","SI-5","Security Alerts, Advisories, and Directives",17,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must receive security alerts, advisories and directives from defined external sources on an ongoing basis, generate internal alerts where needed, disseminate them to the right people and implement directives within set time frames or notify that it cannot.\n\n**In practice.** Doing this well means subscribing to national CSIRT feeds, vendor advisories and threat intelligence relevant to your technology stack, with someone responsible for triaging them and driving action. Auditors expect the list of sources, triage records and evidence that critical advisories led to timely action. In Europe, national CSIRTs and ENISA are typical sources alongside vendors.\n\n**Common gaps.** Advisories arrive in shared mailboxes that nobody reads, or are not matched to the asset inventory. Action on urgent advisories is rarely tracked to closure.","a. Receive system security alerts, advisories, and directives from [Assignment: organization-defined external organizations] on an ongoing basis;\n  b. Generate internal security alerts, advisories, and directives as deemed necessary;\n  c. Disseminate security alerts, advisories, and directives to: [Selection: {{ insert: param, si-05_odp.03 }} ; {{ insert: param, si-05_odp.04 }} ; {{ insert: param, si-05_odp.05 }} ] ; and\n  d. Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.\nDiscussion: The Cybersecurity and Infrastructure Security Agency (CISA) generates security alerts and advisories to maintain situational awareness throughout the Federal Government. Security directives are issued by OMB or other designated organizations with the responsibility and authority to issue such directives. Compliance with security directives is essential due to the critical nature of many of these directives and the potential (immediate) adverse effects on organizational operations and assets, individuals, other organizations, and the Nation should the directives not be implemented in a timely manner. External organizations include supply chain partners, external mission or business partners, external service providers, and other peer or supporting organizations.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},23,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"operation-tornado-354-dark-web-criminals-arrested-through-persistent-law-enforcement-intelligence-ga","Operation TorNado: 354 Dark Web Criminals Arrested Through Persistent Law Enforcement Intelligence Gathering","2026-11-13T12:21:18.576+00:00",{"slug":26,"title":27,"published_at":28},"global-dark-web-crackdown-nets-354-arrests-and-210m-in-assets","Global Dark Web Crackdown Nets 354 Arrests and €210M in Assets","2026-11-13T09:20:58.871+00:00",{"slug":30,"title":31,"published_at":32},"japans-cyberattack-surge-highlights-gaps-in-vulnerability-management-and-ai-assisted-threat-detectio","Japan's Cyberattack Surge Highlights Gaps in Vulnerability Management and AI-Assisted Threat Detection","2026-11-12T21:21:33.229+00:00",{"slug":34,"title":35,"published_at":36},"zero-day-in-n-able-n-central-exploited-within-hours-of-poc-release","Zero-Day in N-able N-central Exploited Within Hours of PoC Release","2026-11-12T20:20:21.277+00:00",{"slug":38,"title":39,"published_at":40},"qilin-administrator-unmasked-through-operational-security-failures","Qilin Administrator Unmasked Through Operational Security Failures","2026-11-11T19:20:43.966+00:00",{"slug":42,"title":43,"published_at":44},"unpatched-windows-clfs-0-day-enables-system-privilege-escalation","Unpatched Windows CLFS 0-Day Enables SYSTEM Privilege Escalation","2026-11-11T14:20:26.827+00:00",{"slug":46,"title":47,"published_at":48},"dark-web-marketplace-co-creator-sentenced-to-40-years-for-430m-in-illegal-sales","Dark Web Marketplace Co-Creator Sentenced to 40 Years for $430M in Illegal Sales","2026-10-12T12:22:35.069+00:00",{"slug":50,"title":51,"published_at":52},"empire-market-operator-sentenced-to-40-years-for-430m-dark-web-empire","Empire Market Operator Sentenced to 40 Years for $430M Dark Web Empire","2026-10-08T12:20:53.648+00:00",{"slug":54,"title":55,"published_at":56},"unpatched-citrix-netscaler-zero-days-actively-exploited-in-the-wild","Unpatched Citrix NetScaler Zero-Days Actively Exploited in the Wild","2026-09-27T10:20:39.64+00:00",{"slug":58,"title":59,"published_at":60},"cisco-email-gateway-zero-day-exploited-before-patch-available","Cisco Email Gateway Zero-Day Exploited Before Patch Available","2026-09-15T16:20:48.677+00:00",{"slug":62,"title":63,"published_at":64},"ransomware-gangs-exploit-unpatched-vmware-vcenter-rce-flaw","Ransomware Gangs Exploit Unpatched VMware vCenter RCE Flaw","2026-09-15T14:22:13.321+00:00",{"slug":66,"title":67,"published_at":68},"record-974-microsoft-vulnerabilities-patched-including-two-actively-exploited-zero-days","Record 974 Microsoft Vulnerabilities Patched, Including Two Actively Exploited Zero-Days","2026-09-08T20:20:18.896+00:00",[70,75,80,85,90,95],{"slug":71,"name":72,"problem":73,"stories":74},"patch-management","Automated patch management","Known holes get closed in days, not months.",12,{"slug":76,"name":77,"problem":78,"stories":79},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",8,{"slug":81,"name":82,"problem":83,"stories":84},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",6,{"slug":86,"name":87,"problem":88,"stories":89},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",5,{"slug":91,"name":92,"problem":93,"stories":94},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",2,{"slug":96,"name":97,"problem":98,"stories":94},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[100,106,110,115,119,124,129,133],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","7","Control 7","Continuous Vulnerability Management",15,{"family":107,"item":108,"code":109,"title":109,"together":74},"itil","overview","ITIL",{"family":101,"item":111,"code":112,"title":113,"together":114},"17","Control 17","Incident Response Management",10,{"family":101,"item":116,"code":117,"title":118,"together":114},"12","Control 12","Network Infrastructure Management",{"family":5,"item":120,"code":121,"title":122,"together":123},"si-2","SI-2","Flaw Remediation",9,{"family":125,"item":126,"code":127,"title":128,"together":84},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",{"family":101,"item":130,"code":131,"title":132,"together":89},"13","Control 13","Network Monitoring and Defense",{"family":134,"item":135,"code":136,"title":137,"together":138},"cisa","kev","KEV","Known Exploited Vulnerabilities (KEV) Catalog",4]