What it covers. NIST guidelines for preventing unauthorised modification of BIOS firmware on PC client systems. They describe an authenticated update mechanism, optional secure local update and protections against bypassing these controls. A related publication, SP 800-147B, applies similar principles to servers.
In practice. Organisations specify in procurement that systems support authenticated BIOS updates, deploy firmware updates through managed processes and protect BIOS configuration with administrator passwords. Firmware is included in vulnerability management. Evidence includes procurement requirements, firmware update records and configuration baselines. Where systems use UEFI secure boot, it is enabled and its keys are managed.
Common gaps. Typical gaps are firmware never updated after deployment and BIOS settings left unprotected. Later guidance, such as SP 800-193, extends these ideas to broader platform firmware.