[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsa-10":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sa-10","SA-10","Developer Configuration Management",14,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Developers of systems, components or services must perform configuration management during design, development, implementation, operation and disposal, document and control changes, implement only approved changes, document approved changes and their security and privacy impacts, and track flaws and their resolution.\n\n**In practice.** For in-house and outsourced development this means version control for all code and configuration, protected branches with reviewed merges, controlled release processes and an issue tracker for security defects. Auditors look for repository settings, merge approval records, release logs and defect tracking. Contracts with external developers should require equivalent practices.\n\n**Common gaps.** Direct commits to main branches, shared repository credentials and pipeline secrets with broad access are common. Security flaws are tracked inconsistently compared with functional bugs.","Require the developer of the system, system component, or system service to:\n  a. Perform configuration management during system, component, or service [Selection: design; development; implementation; operation; disposal];\n  b. Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items];\n  c. Implement only organization-approved changes to the system, component, or service;\n  d. Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and\n  e. Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].\nDiscussion: Organizations consider the quality and completeness of configuration management activities conducted by developers as direct evidence of applying effective security controls. Controls include protecting the master copies of material used to generate security-relevant portions of the system hardware, software, and firmware from unauthorized modification or destruction. Maintaining the integrity of changes to the system, system component, or system service requires strict configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.\n\nThe configuration items that are placed under configuration management include the formal model; the functional, high-level, and low-level design specifications; other design data; implementation documentation; source code and hardware schematics; the current running version of the object code; tools for comparing new versions of security-relevant hardware descriptions and source code with previous versions; and test fixtures and documentation. Depending on the mission and business needs of organizations and the nature of the contractual relationships in place, developers may provide configuration management support during the operations and maintenance stage of the system development life cycle.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"windows-security-update-breaks-smart-app-control-feature","Windows Security Update Breaks Smart App Control Feature","2026-10-16T10:20:27.498+00:00",{"slug":25,"title":26,"published_at":27},"docker-hub-flaw-allowed-cross-user-image-manipulation-for-over-two-years","Docker Hub Flaw Allowed Cross-User Image Manipulation for Over Two Years","2026-10-13T20:21:33.66+00:00",{"slug":29,"title":30,"published_at":31},"rathat-android-malware-persists-after-uninstall-via-adb-abuse","RatHat Android Malware Persists After Uninstall via ADB Abuse","2026-09-18T08:20:53.42+00:00",{"slug":33,"title":34,"published_at":35},"hard-coded-credentials-and-missing-auth-found-in-tycon-systems-firmware","Hard-Coded Credentials and Missing Auth Found in Tycon Systems Firmware","2026-09-03T18:22:44.009+00:00",{"slug":37,"title":38,"published_at":39},"critical-ixon-vpn-client-flaw-enables-root-level-command-execution","Critical IXON VPN Client Flaw Enables Root-Level Command Execution","2026-09-03T18:22:10.747+00:00",{"slug":41,"title":42,"published_at":43},"rockwell-automation-plc-vulnerability-enables-denial-of-service-on-industrial-control-systems","Rockwell Automation PLC Vulnerability Enables Denial-of-Service on Industrial Control Systems","2026-09-01T16:22:05.779+00:00",{"slug":45,"title":46,"published_at":47},"intel-amd-patch-80-vulnerabilities-timely-patching-is-critical","Intel & AMD Patch 80+ Vulnerabilities — Timely Patching Is Critical","2026-08-12T12:21:12.575+00:00",{"slug":49,"title":50,"published_at":51},"ics-vendors-release-critical-patches-for-otics-vulnerabilities","ICS Vendors Release Critical Patches for OT\u002FICS Vulnerabilities","2026-08-12T08:20:22.477+00:00",{"slug":53,"title":54,"published_at":55},"rockwell-arena-simulation-flaws-enable-code-execution-via-malicious-files","Rockwell Arena Simulation Flaws Enable Code Execution via Malicious Files","2026-07-25T10:21:06.608+00:00",{"slug":57,"title":58,"published_at":59},"critical-ics-vulnerabilities-in-automationdirect-productivity-suite-threaten-manufacturing-infrastru","Critical ICS Vulnerabilities in AutomationDirect Productivity Suite Threaten Manufacturing Infrastructure","2026-07-16T18:22:38.225+00:00",{"slug":61,"title":62,"published_at":63},"mistic-backdoor-uses-clickfix-lures-and-dll-side-loading-to-evade-detection","Mistic Backdoor Uses ClickFix Lures and DLL Side-Loading to Evade Detection","2026-06-25T10:20:58.282+00:00",{"slug":65,"title":66,"published_at":67},"massive-github-repository-compromise-highlights-supply-chain-vulnerabilities","Massive GitHub Repository Compromise Highlights Supply Chain Vulnerabilities","2026-05-27T04:48:05.047+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"patch-management","Automated patch management","Known holes get closed in days, not months.",7,{"slug":75,"name":76,"problem":77,"stories":78},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",6,{"slug":80,"name":81,"problem":82,"stories":83},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",5,{"slug":85,"name":86,"problem":87,"stories":88},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",4,{"slug":90,"name":91,"problem":92,"stories":93},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",3,{"slug":95,"name":96,"problem":97,"stories":93},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[99,105,109,114,118,123,127,131],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","2","Control 2","Inventory and Control of Software Assets",10,{"family":100,"item":106,"code":107,"title":108,"together":104},"7","Control 7","Continuous Vulnerability Management",{"family":5,"item":110,"code":111,"title":112,"together":113},"si-2","SI-2","Flaw Remediation",8,{"family":115,"item":116,"code":117,"title":117,"together":78},"itil","overview","ITIL",{"family":119,"item":120,"code":121,"title":122,"together":83},"nist-sp","800-82","SP 800-82","SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security",{"family":100,"item":124,"code":125,"title":126,"together":83},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":100,"item":128,"code":129,"title":130,"together":88},"12","Control 12","Network Infrastructure Management",{"family":132,"item":133,"code":134,"title":135,"together":88},"nerc-cip","cip-007","CIP-007-6","CIP-007: Systems Security Management"]