[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsi-5":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","si-5","SI-5","Security Alerts, Advisories, and Directives",17,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must receive security alerts, advisories and directives from defined external sources on an ongoing basis, generate internal alerts where needed, disseminate them to the right people and implement directives within set time frames or notify that it cannot.\n\n**In practice.** Doing this well means subscribing to national CSIRT feeds, vendor advisories and threat intelligence relevant to your technology stack, with someone responsible for triaging them and driving action. Auditors expect the list of sources, triage records and evidence that critical advisories led to timely action. In Europe, national CSIRTs and ENISA are typical sources alongside vendors.\n\n**Common gaps.** Advisories arrive in shared mailboxes that nobody reads, or are not matched to the asset inventory. Action on urgent advisories is rarely tracked to closure.","a. Receive system security alerts, advisories, and directives from [Assignment: organization-defined external organizations] on an ongoing basis;\n  b. Generate internal security alerts, advisories, and directives as deemed necessary;\n  c. Disseminate security alerts, advisories, and directives to: [Selection: {{ insert: param, si-05_odp.03 }} ; {{ insert: param, si-05_odp.04 }} ; {{ insert: param, si-05_odp.05 }} ] ; and\n  d. Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.\nDiscussion: The Cybersecurity and Infrastructure Security Agency (CISA) generates security alerts and advisories to maintain situational awareness throughout the Federal Government. Security directives are issued by OMB or other designated organizations with the responsibility and authority to issue such directives. Compliance with security directives is essential due to the critical nature of many of these directives and the potential (immediate) adverse effects on organizational operations and assets, individuals, other organizations, and the Nation should the directives not be implemented in a timely manner. External organizations include supply chain partners, external mission or business partners, external service providers, and other peer or supporting organizations.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"dark-web-marketplace-co-creator-sentenced-to-40-years-for-430m-in-illegal-sales","Dark Web Marketplace Co-Creator Sentenced to 40 Years for $430M in Illegal Sales","2026-10-12T12:22:35.069+00:00",{"slug":25,"title":26,"published_at":27},"empire-market-operator-sentenced-to-40-years-for-430m-dark-web-empire","Empire Market Operator Sentenced to 40 Years for $430M Dark Web Empire","2026-10-08T12:20:53.648+00:00",{"slug":29,"title":30,"published_at":31},"unpatched-citrix-netscaler-zero-days-actively-exploited-in-the-wild","Unpatched Citrix NetScaler Zero-Days Actively Exploited in the Wild","2026-09-27T10:20:39.64+00:00",{"slug":33,"title":34,"published_at":35},"cisco-email-gateway-zero-day-exploited-before-patch-available","Cisco Email Gateway Zero-Day Exploited Before Patch Available","2026-09-15T16:20:48.677+00:00",{"slug":37,"title":38,"published_at":39},"ransomware-gangs-exploit-unpatched-vmware-vcenter-rce-flaw","Ransomware Gangs Exploit Unpatched VMware vCenter RCE Flaw","2026-09-15T14:22:13.321+00:00",{"slug":41,"title":42,"published_at":43},"record-974-microsoft-vulnerabilities-patched-including-two-actively-exploited-zero-days","Record 974 Microsoft Vulnerabilities Patched, Including Two Actively Exploited Zero-Days","2026-09-08T20:20:18.896+00:00",{"slug":45,"title":46,"published_at":47},"liquid-network-loses-47m-after-elements-software-bug-exploited","Liquid Network Loses $47M After Elements Software Bug Exploited","2026-09-08T16:21:36.982+00:00",{"slug":49,"title":50,"published_at":51},"cisco-warns-of-unpatched-email-and-critical-switch-vulnerabilities","Cisco Warns of Unpatched Email and Critical Switch Vulnerabilities","2026-09-03T12:21:59.956+00:00",{"slug":53,"title":54,"published_at":55},"price-oracle-manipulation-drains-74m-from-defi-lending-protocol","Price Oracle Manipulation Drains $74M from DeFi Lending Protocol","2026-08-31T22:20:56.025+00:00",{"slug":57,"title":58,"published_at":59},"kriminal-ai-platform-lowers-barrier-to-entry-for-cybercrime","Kriminal AI Platform Lowers Barrier to Entry for Cybercrime","2026-08-19T22:21:06.396+00:00",{"slug":61,"title":62,"published_at":63},"ics-vendors-release-critical-patches-for-otics-vulnerabilities","ICS Vendors Release Critical Patches for OT\u002FICS Vulnerabilities","2026-08-12T08:20:22.477+00:00",{"slug":65,"title":66,"published_at":67},"eu-uk-sanction-gru-hackers-targeting-critical-infrastructure","EU & UK Sanction GRU Hackers Targeting Critical Infrastructure","2026-07-13T12:20:39.223+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"patch-management","Automated patch management","Known holes get closed in days, not months.",9,{"slug":75,"name":76,"problem":77,"stories":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",7,{"slug":80,"name":81,"problem":82,"stories":83},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",4,{"slug":85,"name":86,"problem":87,"stories":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",3,{"slug":90,"name":91,"problem":92,"stories":93},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",2,{"slug":95,"name":96,"problem":97,"stories":98},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,[100,105,110,114,118,124,128,133],{"family":101,"item":102,"code":103,"title":103,"together":104},"itil","overview","ITIL",12,{"family":106,"item":107,"code":108,"title":109,"together":104},"cis","7","Control 7","Continuous Vulnerability Management",{"family":106,"item":111,"code":112,"title":113,"together":73},"12","Control 12","Network Infrastructure Management",{"family":5,"item":115,"code":116,"title":117,"together":73},"si-2","SI-2","Flaw Remediation",{"family":119,"item":120,"code":121,"title":122,"together":123},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",6,{"family":106,"item":125,"code":126,"title":127,"together":123},"17","Control 17","Incident Response Management",{"family":106,"item":129,"code":130,"title":131,"together":132},"13","Control 13","Network Monitoring and Defense",5,{"family":134,"item":135,"code":136,"title":137,"together":83},"cisa","kev","KEV","Known Exploited Vulnerabilities (KEV) Catalog"]