[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsa-12":3},{"item":4,"lessons":17,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":15,"updated_at":16},"nist-800-53","sa-12","SA-12","Supply Chain Protection",304,"US National Institute of Standards and Technology (NIST)","**What it asks for.** SA-12 Supply Chain Protection existed in Revision 4 of SP 800-53. In Revision 5 it was withdrawn and its content moved into the new Supply Chain Risk Management (SR) family. The underlying aim remains protecting against supply chain threats to systems, components and services.\n\n**In practice.** Organisations working to Revision 5 should look at controls such as SR-3 (supply chain controls and processes), SR-6 (supplier assessments and reviews) and SR-11 (component authenticity). Typical activities include a supplier risk process, security requirements in contracts, assessment of critical suppliers and checks on the origin and integrity of software and hardware. Auditors would expect to see the current SR controls mapped, rather than SA-12, in a Revision 5 assessment.\n\n**Common gaps.** A common gap is carrying old Revision 4 mappings forward without updating them to the SR family. Supplier risk activity is also often limited to onboarding questionnaires with no ongoing review.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST","This control was withdrawn in SP 800-53 Rev. 5; its content moved to other controls.","2026-10-18T15:18:43.663+00:00",{"total":9,"list":18},[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"malicious-npm-package-imgdecode-delivers-hidden-shellcode-loader","Malicious npm Package 'imgdecode' Delivers Hidden Shellcode Loader","2026-10-17T12:20:17.17+00:00",{"slug":24,"title":25,"published_at":26},"malicious-aur-packages-execute-root-level-malware-via-typosquatting","Malicious AUR Packages Execute Root-Level Malware via Typosquatting","2026-10-15T18:20:20.988+00:00",{"slug":28,"title":29,"published_at":30},"critical-rce-flaws-in-nextjs-demand-immediate-patching","Critical RCE Flaws in Next.js Demand Immediate Patching","2026-10-15T16:21:23.504+00:00",{"slug":32,"title":33,"published_at":34},"android-rat-hirudo-swaps-legitimate-banking-apps-with-trojanized-clones","Android RAT 'Hirudo' Swaps Legitimate Banking Apps with Trojanized Clones","2026-10-15T12:21:08.907+00:00",{"slug":36,"title":37,"published_at":38},"hardware-implants-in-crypto-wallets-expose-supply-chain-risks","Hardware Implants in Crypto Wallets Expose Supply-Chain Risks","2026-10-14T18:20:46.881+00:00",{"slug":40,"title":41,"published_at":42},"hardware-implant-in-reseller-crypto-wallets-drains-86m","Hardware Implant in Reseller Crypto Wallets Drains $86M","2026-10-13T12:21:47.245+00:00",{"slug":44,"title":45,"published_at":46},"hardware-implants-in-resold-crypto-wallets-expose-supply-chain-risk","Hardware Implants in Resold Crypto Wallets Expose Supply Chain Risk","2026-10-12T14:22:09.278+00:00",{"slug":48,"title":49,"published_at":50},"ai-agents-exploited-via-malicious-package-supply-chain-attacks","AI Agents Exploited via Malicious Package Supply Chain Attacks","2026-10-12T13:20:21.797+00:00",{"slug":52,"title":53,"published_at":54},"ghostaction-campaign-hijacks-github-maintainer-accounts-to-steal-cloud-credentials-at-scale","GhostAction Campaign Hijacks GitHub Maintainer Accounts to Steal Cloud Credentials at Scale","2026-10-09T14:21:15.572+00:00",{"slug":56,"title":57,"published_at":58},"chinese-state-sponsored-tools-targeted-critical-infrastructure-via-vulnerability-scanning","Chinese State-Sponsored Tools Targeted Critical Infrastructure via Vulnerability Scanning","2026-10-08T22:20:23.684+00:00",{"slug":60,"title":61,"published_at":62},"pre-installed-malware-in-low-cost-android-firmware-highlights-supply-chain-risk","Pre-Installed Malware in Low-Cost Android Firmware Highlights Supply Chain Risk","2026-10-08T20:20:42.159+00:00",{"slug":64,"title":65,"published_at":66},"fakegit-campaign-uses-17000-malicious-github-repos-to-spread-malware","FakeGit Campaign Uses 17,000+ Malicious GitHub Repos to Spread Malware","2026-10-08T18:20:38.285+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",152,{"slug":74,"name":75,"problem":76,"stories":77},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",147,{"slug":79,"name":80,"problem":81,"stories":82},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",80,{"slug":84,"name":85,"problem":86,"stories":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",67,{"slug":89,"name":90,"problem":91,"stories":92},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",64,{"slug":94,"name":95,"problem":96,"stories":97},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",51,[99,105,111,117,122,127,133,138],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","2","Control 2","Inventory and Control of Software Assets",256,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",199,{"family":112,"item":113,"code":114,"title":115,"together":116},"gdpr","32","Article 32","Security of processing",146,{"family":100,"item":118,"code":119,"title":120,"together":121},"16","Control 16","Application Software Security",138,{"family":100,"item":123,"code":124,"title":125,"together":126},"7","Control 7","Continuous Vulnerability Management",117,{"family":128,"item":129,"code":130,"title":131,"together":132},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",111,{"family":5,"item":134,"code":135,"title":136,"together":137},"si-3","SI-3","Malicious Code Protection",97,{"family":139,"item":129,"code":140,"title":140,"together":141},"itil","ITIL",85]