[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-128":3},{"item":4,"lessons":16,"controls":46,"related":74},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-128","SP 800-128","SP 800-128: Guide for Security-Focused Configuration Management of Information Systems",7,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance on managing configurations with security in mind. It covers planning, identifying and implementing secure baseline configurations, controlling changes and monitoring systems for deviation from baselines. It builds on the configuration management controls of SP 800-53 and applies to any type of system.\n\n**In practice.** Applying it well means defining secure baselines for each system type, often from recognised benchmarks, applying them consistently through automation and controlling changes with security impact analysis. Systems are monitored for drift and deviations are corrected or approved. Evidence includes baselines, change records and compliance scan results.\n\n**Common gaps.** Typical gaps are baselines that exist only for some platforms, manual changes outside change control and no detection of configuration drift. Baselines also tend to go out of date when platforms change. Changes made during incidents are often not documented afterwards.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42],{"slug":19,"title":20,"published_at":21},"windows-update-kb5124010-crashes-games-and-apps-using-ac-3-audio","Windows Update KB5124010 Crashes Games and Apps Using AC-3 Audio","2026-10-05T10:20:37.982+00:00",{"slug":23,"title":24,"published_at":25},"malicious-linux-backdoors-impersonate-legitimate-mail-security-products","Malicious Linux Backdoors Impersonate Legitimate Mail Security Products","2026-10-02T14:20:37.948+00:00",{"slug":27,"title":28,"published_at":29},"microsoft-pauses-kb5002907-why-staged-patch-validation-matters","Microsoft Pauses KB5002907: Why Staged Patch Validation Matters","2026-09-29T10:21:25.401+00:00",{"slug":31,"title":32,"published_at":33},"microsoft-security-update-breaks-domain-logins-via-enforcement-mode-bug","Microsoft Security Update Breaks Domain Logins via Enforcement Mode Bug","2026-09-17T10:21:14.734+00:00",{"slug":35,"title":36,"published_at":37},"microsoft-excel-update-kb5002914-breaks-core-functionality-for-users","Microsoft Excel Update KB5002914 Breaks Core Functionality for Users","2026-09-10T20:20:57.076+00:00",{"slug":39,"title":40,"published_at":41},"august-net-update-breaks-wpf-printing-patch-trade-offs-demand-careful-rollout","August .NET Update Breaks WPF Printing — Patch Trade-offs Demand Careful Rollout","2026-08-24T14:20:41.401+00:00",{"slug":43,"title":44,"published_at":45},"chrome-151-patches-370-vulnerabilities-including-7-critical-bugs","Chrome 151 Patches 370 Vulnerabilities Including 7 Critical Bugs","2026-07-30T08:20:23.911+00:00",[47,52,57,62,66,70],{"slug":48,"name":49,"problem":50,"stories":51},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":53,"name":54,"problem":55,"stories":56},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",2,{"slug":58,"name":59,"problem":60,"stories":61},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",1,{"slug":63,"name":64,"problem":65,"stories":61},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":67,"name":68,"problem":69,"stories":61},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":71,"name":72,"problem":73,"stories":61},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[75,80,85,90,96,100,104,108],{"family":76,"item":77,"code":78,"title":78,"together":79},"itil","overview","ITIL",6,{"family":81,"item":82,"code":83,"title":84,"together":79},"cis","7","Control 7","Continuous Vulnerability Management",{"family":5,"item":86,"code":87,"title":88,"together":89},"800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",5,{"family":91,"item":92,"code":93,"title":94,"together":95},"nist-800-53","si-2","SI-2","Flaw Remediation",3,{"family":81,"item":97,"code":98,"title":99,"together":95},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":81,"item":101,"code":102,"title":103,"together":95},"2","Control 2","Inventory and Control of Software Assets",{"family":91,"item":105,"code":106,"title":107,"together":95},"cm-3","CM-3","Configuration Change Control",{"family":109,"item":110,"code":111,"title":112,"together":61},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities"]